curl in Shell Script run by splunk return empty

pdevosceazure · ‎03-05-2017

I am trying to get data from a third party API

so I get splunk to run this very basic script.

if I run the script in shell it works perfect.
if it is run by splunk $ip is empty

I know splunk can execute the script because I replace $(curl.... by "test" and splunk collects it OK.

splunk seams to be executing script as root because if chance my script to
whoiam
splunk returns root.

it is not just this url i tried different ones, it works in shell but it is always empty when run by splunk.

koshyk · ‎03-05-2017

The best way to integrate with API is to use "REST modular Input" within splunk rather than calling a script etc.

There are some good docs out there, thus making your "splunk" application itself to handle API requests

pdevosceazure · ‎03-06-2017

I had seen this but could not find in in splunk any where in 6.5.
did not realise is as an add on. will try it out.

harsmarvania57 · ‎03-05-2017

Hi,

Can you please try below command in your script, added ().

IP=($(curl -s 'http://api.openweathermap.org/data/2.5/weather?q=london,uk≈pid=xxxxxxxxxxxxxxxxxxxxxxx'))

Thanks,
Harshil