Splunk Dev

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

chasrini
New Member

How to download lookup file from an App or statistics from Splunk using JAVA REST API or Python

Labels (3)
0 Karma
1 Solution

starcher
Influencer

Simplest solution is execute an inputlookup command and parse the search results

View solution in original post

0 Karma

starcher
Influencer

Simplest solution is execute an inputlookup command and parse the search results

0 Karma

chasrini
New Member

Thanks for the update. They have kept the lookup csv file in a custom app. Its not on the "Search & Reporting" app. so I am not able to fetch the CSV result from that app. I tried using python like below but it returned resp code 200 and not the data present in CSV file. Is there any function or method thru which I can get the CSV file info.

import json
import csv
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

splunkApp = "splunk_xxx"
splunkUser = "xx"
splunkPwd = "xx"
splunkURI = "https://splunkxx.trusted.xxx.com:port/en-US/manager/splunk_xx/data/lookup-table-files"
lookupName = "xx.csv"
lookupUpdateURI = "%s/%s" % (splunkURI, lookupName)

headers = {'Content-Type': 'application/json'}
data = {"eai:data" : "/opt/splunk/sh/splunk/etc/apps/splunk_xx/lookups/xx.csv"}
r = requests.get(lookupUpdateURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)
print(r)

0 Karma

chasrini
New Member

I was able to download inputlookup using JAVA SDK. Still some of the inputlookup I am not able to download, since they are kept in an APP in a different server where I am not connecting to.

The server where APP is present is not REST API enabled.
The server where REST API is enabled, they dont have that APP here.

The Application team dont want to move the inputlookup file from the APP where REST API is not enabled.

so If you know any way we can move the lookup csv file from one server to other server where REST API is enabled, either through splunk query or through an alert or any ways, will be helpful.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...