fetching data in Splunk using rest api

0
votes

I want to import XML data to Splunk using below .py script

My concerns are:

  1. Can I directly configure .py script output to index data in splunk using inputs.conf, or do I need to save output first into a .csv file. If yes can anyone please suggest some approach so that data does not get changed after storing it into a new .csv file.
  2. How can I configure that .py file to fetch data in every 5 min.
import requests
import xmltodict
import json
 
url = "https://www.w3schools.com/xml/plant_catalog.xml"
 
response = requests.get(url)
content=xmltodict.parse(response.text)
print(content)
1
splunksplunk-query

1 Answers

2
votes

If you put your Python script into a [script://] stanza in inputs.conf then not only can you have Splunk launch the script automatically every 5 minutes, but anything the script writes to stdout will be indexed in Splunk.

[script:///path/to/the/script.py]
interval = 1/5 * * * *
index = main
sourcetype = foo