Log data from dataPower to splunk

Question

The question might be looking easy but I am quite struck on this.

I have a requirement whereby I have to store data regarding Timestamp,latency,serviceName etc in a variable and then log that into splunk.

However I am unable to call splunk through datapower xslt.

How can we call splunk through datapower using XSLT

Thanks

Answer 1

Splunk has several interfaces, but XSLT is not one of them. Lucky for you, there's already a Splunk app that can collect data from Datapower and index it. See https://splunkbase.splunk.com/app/3517/.

Answer 2

I would consider using the Splunk HTTP Event Collector.

You can use XSLT ou Gatewayscript, in conjunction with the Datapower urlopen function (available in both language), to make a simple http call to the collector.

I found here (Code under Apache license) that the call is as simple as a call to https://SPLUNK_SVR:8088/services/collector/event/1.0 with the following body:

{
    "source": "chicken coop",
    "sourcetype": "httpevent",
    "index": "main",
    "host": "farm.local",
    "event": {
        "message": {
            "chickenCount": 500
            "msg": "Chicken coup looks stable.",
            "name": "my logger",
            "put": 98884,
            "temperature": "70F",
            "v": 0
        },
        "severity": "info"
    }
}

I think it would work better on the datapower by using gateway script, an example of such a call can be found here. Look for the first example. You will find similar code, in which I modified the "Data" section:

//Could be added to a library    
var urlopen = require('urlopen');

var jsonData = '{
"source": "Datapower",
"sourcetype": "SOMETHING DYNAMIC",
"index": "main",
"host": "GET_THIS_FROM_DP_VARIABLES",
"event": {
    "message": {
        "SOMECOUNTER": 500
        "msg": "SOME INTERESTING INFORMATION.",
        "name": "GET_THIS_FROM_DP_VARIABLES",
        "put": 3333,
        "yadayada": "foo",
        "bar": 0
        },
        "severity": "info"
    }
}';

var options = {
            target: 'https://SPLUNK_SVR:8088/services/collector/event/1.0',
            method: 'POST',
           headers: { },
       contentType: 'text/plain',
           timeout: 60,
  sslClientProfile: 'AN_EXISTING_SSL_PROFILE_ON_DATAPOWER',
              data: jsonData};

urlopen.open(options, function(error, response) {
  if (error) {
    // an error occurred during the request sending or response header parsing
    console.error("Splunk Logging - urlopen error: "+JSON.stringify(error));
  } else {
    // get the response status code
    var responseStatusCode = response.statusCode;
    var responseReasonPhrase = response.reasonPhrase;
    console.log("Splunk Logging - status code: " + responseStatusCode);
    console.log("Splunk Logging - reason phrase: " + responseReasonPhrase);
    // no need to read response data - This is just logging
  }
});