Custom REST Command (crest)
Overview
Details
The crest command addresses this by providing a seamless, native way to send HTTP requests (GET, POST, DELETE) directly from Splunk. This empowers users to fetch, update, or delete data from external systems in real time, fully leveraging Splunk’s data visualization and analysis capabilities. Whether you're integrating with third-party services, automating repetitive tasks, or interacting with internal APIs, crest ensures efficiency, speed, and simplicity.
Why You Need This App
1. Simplifies API Workflows: No need for external scripts—execute HTTP requests within Splunk searches.
2. Real-Time Integration: Fetch or modify data from external systems on the fly, staying updated without manual effort.
3. Enhanced Debugging: Built-in debug mode lets you validate configurations before executing, saving time and reducing errors.
4. Flexibility & Security: With support for custom headers, SSL verification, and session authentication, crest adapts to your security and operational needs.
5. Optimized Decision-Making: Consolidate external data with Splunk insights to enable faster, more informed decisions.
By combining the power of Splunk with direct RESTful API interaction, Custom REST Command transforms your data workflows into an agile, integrated system. Try it today to experience streamlined API management and enriched data analysis.
Custom REST Command (crest)
The crest command is a custom Splunk search command that allows you to send HTTP requests directly from your Splunk searches. It supports GET, POST, and DELETE methods, allowing you to interact with RESTful APIs and web services within your Splunk environment.
This command is shipped with the Custom REST Command app.
Table of Contents
Syntax
| crest url=<string> method=<string> [data=<string>] [headers=<string>] [debug=<boolean>] [verify=<boolean>] [timeout=<int>]
- Note: Square brackets
[]denote optional parameters.
Parameters
url(required): The endpoint URL to send the HTTP request to.method(required): The HTTP method to use. Supported methods areget,post, anddelete.data(optional): The payload to send with aPOSTrequest. Should be a JSON-formatted string.headers(optional): Custom headers to include in the request. Should be a JSON-formatted string.debug(optional): Set totrueto enable debug mode, which displays request details without executing the request.verify(optional): Set tofalseto disable SSL verification in your REST calls. Be careful with this option!timeout(optional): Default is 10s, but you can change it according to your needs..
Usage
Example 1: GET Request
Send a GET request to http://example.com/api.
| crest url="http://example.com/api" method="get"
Explanation: This command sends a GET request to the specified URL and returns the response data in the search results.
Example 2: POST Request
Send a POST request with a data payload to http://example.com/api.
| crest url="http://example.com/api" method="post" data="{'key':'value'}"
Explanation: This command sends a POST request to the specified URL with the provided JSON data as the payload.
Example 3: DELETE Request
Send a DELETE request to http://example.com/api/resource.
| crest url="http://example.com/api/resource" method="delete"
Explanation: This command sends a DELETE request to remove the specified resource at the given URL.
Notes
- SSL Verification: SSL verification is enabled by default. Ensure that your Splunk instance can verify the SSL certificates of the endpoints you are accessing. If you need to disable SSL verification (not recommended due to security risks), you can include the option
verify="false"in the command. - Session Authorization: When making requests to
localhost, the command automatically includes the Splunk session key in theAuthorizationheader. This uses your user to authenticate the internal request. - Timeouts: The command uses a default timeout of 10 seconds for HTTP requests. You can change this using the timeout option if necessary.
License
This app is licensed under the MIT License.
Disclaimer: Use this command responsibly. Make sure you have permission to access the URLs you are querying, and be aware of the load and security implications of sending HTTP requests from your Splunk instance.
Release Notes
Version 2.1.2-beta
Stopped loading data option as JSON. Leaving as String.
Version 2.1.1-beta
Debug mode fixed.
Version 2.0.1-beta
README update.
Version 2.0.0-beta
Custom REST Command (crest)
The crest command is a custom Splunk search command that allows you to send HTTP requests directly from your Splunk searches. It supports GET, POST, and DELETE methods, allowing you to interact with RESTful APIs and web services within your Splunk environment.
This command is shipped with the Custom REST Command app.
Table of Contents
Installation
To install the Custom REST Command app and use the crest command:
- Download the App: Obtain the app package from Splunkbase.
- Access Splunk Web: Log in to your Splunk instance.
- Navigate to Manage Apps:
- Click on the Apps menu.
- Select Manage Apps.
- Install the App:
- Click on Install app from file.
- Upload the app package.
- Click Upload and follow the prompts.
- Restart Splunk: Some installations may require a restart. If prompted, restart your Splunk instance to complete the installation.
Syntax
| crest url=<string> method=<string> [data=<string>] [headers=<string>] [debug=<boolean>] [verify=<boolean>] [timeout=<int>]
- Note: Square brackets
[]denote optional parameters.
Parameters
url(required): The endpoint URL to send the HTTP request to.method(required): The HTTP method to use. Supported methods areget,post, anddelete.data(optional): The payload to send with aPOSTrequest. Should be a JSON-formatted string.headers(optional): Custom headers to include in the request. Should be a JSON-formatted string.debug(optional): Set totrueto enable debug mode, which displays request details without executing the request.verify(optional): Set tofalseto disable SSL verification in your REST calls. Be careful with this option!timeout(optional): Default is 10s, but you can change it according to your needs..
Usage
Example 1: GET Request
Send a GET request to http://example.com/api.
| crest url="http://example.com/api" method="get"
Explanation: This command sends a GET request to the specified URL and returns the response data in the search results.
Example 2: POST Request
Send a POST request with a data payload to http://example.com/api.
| crest url="http://example.com/api" method="post" data="{'key':'value'}"
Explanation: This command sends a POST request to the specified URL with the provided JSON data as the payload.
Example 3: DELETE Request
Send a DELETE request to http://example.com/api/resource.
| crest url="http://example.com/api/resource" method="delete"
Explanation: This command sends a DELETE request to remove the specified resource at the given URL.
Debug Mode
Use the debug parameter to display the request details without executing the actual HTTP request. This is useful for verifying the request configuration.
| crest url="http://example.com/api" method="get" debug="true"
Explanation: When debug is set to true, the command outputs the request details (such as url, method, headers, and data) without sending the HTTP request.
Notes
- SSL Verification: SSL verification is enabled by default. Ensure that your Splunk instance can verify the SSL certificates of the endpoints you are accessing. If you need to disable SSL verification (not recommended due to security risks), you can include the option
verify="false"in the command. - Session Authorization: When making requests to
localhost, the command automatically includes the Splunk session key in theAuthorizationheader. This uses your user to authenticate the internal request. - Timeouts: The command uses a default timeout of 10 seconds for HTTP requests. You can change this using the timeout option if necessary.
- Error Handling: The command includes error handling for network problems and invalid parameters.
- Data Payloads: When sending JSON data in the
dataandheaderparameters, make sure it is properly formatted. For example:data="{\"user\":\"matheus\",\"role\":\"admin\"}"
License
This app is licensed under the MIT License.
Disclaimer: Use this command responsibly. Make sure you have permission to access the URLs you are querying, and be aware of the load and security implications of sending HTTP requests from your Splunk instance.