Getting Data In

Splunk Adaptive Response sending post command in REST API

ramesh_babu71
Path Finder

Hi,

I am trying to create a new app which will be used to send a Splunk Adaptive response via REST API. I am able get the response from Splunk REST API using using below code

     headers_server, content_server = rest.simpleRequest('/services/server/info?output_mode=json', sessionKey=sessionKey)

However my requirement is to convert the below curl command which has a POST action to python REST API.

curl -k -u admin:Password1 https://localhost:8089/services/data/inputs/script/restart?output_mode=json -d script=".\bin\script_test\windows.bat"

Would require you help on how to send this POST command in python REST API format.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @ramesh_babu71,

Please try this python code

   rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

EDIT1: Updated code, but what you want to achieve. It seems like /services/data/inputs/script/restartgiving me HTTP 400 error with GET request but didn't tried POST request.

EDIT2: Based on this doc http://docs.splunk.com/Documentation/Splunk/6.6.4/RESTREF/RESTinput#data.2Finputs.2Fscript.2Frestart
POST request should be like

rest.simpleRequest('/servicesNS/nobody/<APPNAME>/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi @ramesh_babu71,

Please try this python code

   rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)

EDIT1: Updated code, but what you want to achieve. It seems like /services/data/inputs/script/restartgiving me HTTP 400 error with GET request but didn't tried POST request.

EDIT2: Based on this doc http://docs.splunk.com/Documentation/Splunk/6.6.4/RESTREF/RESTinput#data.2Finputs.2Fscript.2Frestart
POST request should be like

rest.simpleRequest('/servicesNS/nobody/<APPNAME>/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': ".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)
0 Karma

ramesh_babu71
Path Finder

Thanks Harshil. This is what I was looking for. The POST command lets me to restart/enable the scripted input

However a slight modification was required as \b in ".\bin...."python is taken as ASCII so we have to tell python to take it as string using r in front

 rest.simpleRequest('/services/data/inputs/script/restart', sessionKey=sessionKey, postargs={'script': r".\bin\script_test\windows.bat"}, method='POST', raiseAllErrors=True)
0 Karma

harsmarvania57
Ultra Champion

Great that it helped you, I have converted my comment to answer so you can accept it and thanks for the explanation about ASCII character.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...