All Apps and Add-ons

¿how to get data from facebook api to splunk?

jperezh
Explorer

I'm new to splunk and I wanted to know how to get data from the facebook api to splunk. I have read that there was an app for splunk but it got removed, also that there is a way to do it by using the REST api but I don't understand how does it work.

Thanks

P.D

There are python scripts that scrap facebook, can I use one of them to send the data to Splunk? how do I do it?

0 Karma

jperezh
Explorer

I haven't been able to input data from the SPLUNK REST_API bu i have this is script that fetch the data and allow me to store it in a variable or a file like json or csv. I want to know if its possible to send the variable or the data stream directly to Splunk as individual events. Heres is my code:

from facepy import GraphAPI
import urllib



access = 'token'

graph = GraphAPI(access)
page_id= 'id'
datas= graph.get(page_id+'/posts?fields=message,likes, name', page=True, retry=5, limit=2)

posts=[]

for data in datas:
    posts.append(data)

the question is, how can I send the data to splunk as individual events, one for each post for example.

0 Karma

lukas_loder
Communicator

Hi jperezh

I'm indexing for example the number of likes of our facebook group. For this you need to have access to your GraphApi from Facebook. There you need to create an API key which is allowed to read this information.
Than I'm using the REST Api Modular Input (https://splunkbase.splunk.com/app/1546/) with following configuration:

Endpoint URL: https://graph.facebook.com/v2.5/me?fields=likes&access_token=YOURTOKEN
Http Method: Get
Authentication Type: None
Response Type: json

What kind of information do you want to load from Facebook? And are you the owner from the group?

0 Karma

jperezh
Explorer

Hi lukas.loder, thanks for replying. I'm interested in comments, user who comment, and likes. For now I'm aiming to do it with my own personal page, I have already set an input with the REST API:
Endpoint url: https://graph.facebook.com/v2.6/JuanJP88/feed?fields=from,message,created_time,id,actions,event,comm...
Http Method: Get
Authentication Type: None
Response Type: json
But after that I don't know what to do.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...