SPLK-DSRAPI - Developing with Splunk's REST API

This 9-hour course is for developers who want to use the Splunk REST API to interact with Splunk servers. In this course, use curl and Python to send requests to Splunk REST endpoints and learn how to parse and use the results. Create a variety of objects in Splunk, learn how to change properties, work with and apply security to Splunk objects, run different types of searches and parse its results, ingest data using the HTTP Event Collector and manipulate collections and KV Stores.

Duration: 2.0 days

Enquire Now

Start learning today!

Click Hereto customize your Training

Objectives

  • Introduction to the Splunk REST API
  • Namespaces and Object Management
  • Parsing Output
  • Oneshot Searches
  • Normal and Export Searches
  • Advanced Searching and Job Management
  • Working with KV Stores
  • Using the HTTP Event Collector (HEC)

Content

Module 1 – Introduction to the Splunk REST API

  • Introduce the Splunk development environment and its REST endpoints
  • Connect to the appropriate Splunk server to accomplish a desired task
  • Authenticate with a Splunk server, with and without a session

Module 2 – Namespaces and Object Management

  • Understand general CRUD with the REST API
  • Identify how a namespace affects access to objects
  • Use the servicesNS node and a namespace to access objects
  • Understand how the sharing level and access control lists affect access to objects
  • Modify the sharing level and the permissions on an object

Module 3 – Parsing Output

  • Understand the general structure of Atom-based output
  • Format Atom-based XML and JSON output
  • Write code that uses the API and parse responses

Module 4 – Oneshot Searches

  • Review search language syntax and search best practices
  • Execute oneshot searches
  • Get search results and parse them

Module 5 – Normal and Export Searches

  • Identify types of searches
  • Execute normal and export searches
  • Get search results, job status and search job properties.

Module 6 – Advanced Searching and Job Management

  • Execute real-time searches
  • Work with saved searches
  • Manage search jobs

Module 7 – Working with KV Stores

  • Define the function of a KV Store
  • Define collections and records
  • Perform CRUD operations on collections and records

Module 8 – Using the HTTP Event Collector (HEC)

  • Create and use HEC tokens
  • Input data using HEC endpoints
  • Get indexer event acknowledgements

Module 9 – Useful Admin REST APIs

  • Get system information
  • Manage Splunk configuration files
  • Manage Indexes

Module 10 – Custom REST Endpoints

  • Extending the Splunk REST API
  • Publish your own endpoints
  • Using custom REST API endpoints

Audience

  • Splunk Administrator
  • Developer
  • User
  • Knowledge Manager
  • Architect

Prerequisites

To be successful, students should have a solid understanding of the following:

  • Splunk Fundamentals 1 and 2

Or the following single-subject courses:

  • What is Splunk?
  • Intro to Splunk
  • Using Fields
  • Working with Time
  • Statistical Processing
  • Search Under the Hood
  • Introduction to Knowledge Objects

Students should also understand the following courses:

  • Splunk Enterprise Data Administration (Recommended)

Certification

product-certification

Course Benefits

product-benefits
  • Career growth
  • Broad Career opportunities
  • Worldwide recognition from leaders
  • Up-to Date technical skills
  • Popular Certification Badges

Splunk Popular Courses

splk-sefs

This "Fast Start" course covers over 60 commands and functions and prepares students to be search experts.

splk-iiss

This course prepares security practitioners to use SOAR to respond to security incidents.

splk-dyd

This course focuses on creating inputs, chain searches, event annotations, and improving dashboard performance.

splk-introdyd

This course focuses on dashboard creation, including prototyping, the dashboard definition, layouts types, adding visualizations, and dynamic coloring.
Enquire Now
 
 
 
 
k9hlxk
By clicking "Submit", I agree to the Terms Of Use and Privacy Policy