Getting Data In

What is the feasibility of using Splunk REST calls from an Angular application running HTLM5 to send data into Splunk directly from the browser?

jamesoconnell
Path Finder

We have a partner who wants an extremely light interface to send data into a Splunk instance.
They prefer to make a simple REST call directly from the browser to load a JSON payload into Splunk.
The goal is to NOT have a heavy server-side process, but rather a lightweight REST interface directly to Splunk.

The data would be keyed on the user working in the browser at the time of the call out.
The data would be accessed in a Splunk dashboard/report keying on the user and his/her data.

I saw a recommendation from another post regarding HTTP Event Collector for this purpose. On first thought this seems feasible, but I am interested in knowing the pluses and minuses of both solutions.

Regards.

1 Solution

murbanek_splunk
Splunk Employee
Splunk Employee

This is an interesting use case. This does certainly look like an ideal use case for the http event collector on the heavy forwarder, here are a few reasons why:

  • The heavy forwarder with http event collector is built for this sort of demand
  • Lightweight is relative, a solution needs to be available and resilient and scalable.
  • Depending on how your network topology is segmented, you'll want a heavy forwarder with an http event collector (not an indexer) as close to the edge as possible: http://dev.splunk.com/view/event-collector/SP-CAAAE73 . see Scenario 2 & 3. You didn't mention if this was for internet facing http calls, but I'm assuming they are.
  • Reusability, should similar use cases arise in the future, you now have a solution that can be shared with other application needs.

Cheers

View solution in original post

murbanek_splunk
Splunk Employee
Splunk Employee

This is an interesting use case. This does certainly look like an ideal use case for the http event collector on the heavy forwarder, here are a few reasons why:

  • The heavy forwarder with http event collector is built for this sort of demand
  • Lightweight is relative, a solution needs to be available and resilient and scalable.
  • Depending on how your network topology is segmented, you'll want a heavy forwarder with an http event collector (not an indexer) as close to the edge as possible: http://dev.splunk.com/view/event-collector/SP-CAAAE73 . see Scenario 2 & 3. You didn't mention if this was for internet facing http calls, but I'm assuming they are.
  • Reusability, should similar use cases arise in the future, you now have a solution that can be shared with other application needs.

Cheers

jamesoconnell
Path Finder

Thanks for the quick response Michael.

I'll work with our partner to get them started on using our existing HTTP Event Collectors.
cheers,
-Jim O.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...