Description
Who should attend
This 9-hour course is for developers who want to use the Splunk REST API to interact with Splunk servers.
Certifications
This course is part of the following Certifications:
Splunk Certified Developer
Prerequisites
To be successful, students should have a solid understanding of the following:
- Splunk Fundamentals 1 and 2 (Retired)
Or the following single-subject courses:
What is Splunk? (WIS)
Intro to Splunk (ITS)
Using Fields (Free) (SUFF) or Using Fields (SUF)
Working with Time (WWT)
Statistical Processing (SSP)
Search Under the Hood (SUH)
Intro to Knowledge Objects (IKO)
Students should also understand the following courses:
Splunk Enterprise Data Administration (SEDA) (Recommended)
Course Objectives
- Introduction to the Splunk REST API
- Namespaces and Object Management
- Parsing Output
- Oneshot Searching
- Normal and Export Searching
- Advanced Searching and Job Management
- Working with KV Stores
- Using the HTTP Event Collector (HEC)
Outline: Developing with Splunk’s REST API (DSRAPI)
Module 1 – Introduction to the Splunk REST API
- Introduce the Splunk development environment and its REST endpoints
- Connect to the appropriate Splunk server to accomplish a desired task
- Authenticate with a Splunk server, with and without a session
Module 2 – Namespaces and Object Management
- Understand general CRUD with the REST API
- Identify how a namespace affects access to objects
- Use the servicesNS node and a namespace to access objects
- Understand how the sharing level and access control lists affect access to objects
- Modify the sharing level and the permissions on an object
Module 3 – Parsing Output
- Understand the general structure of Atom-based output
- Format Atom-based JSON output
- Write code that uses the API and parse responses
Module 4 – Oneshot Searches
- Review search language syntax and search best practices
- Execute one shot searches
- Get search results
Module 5–Normal and Export Searches
- Identify types of searches
- Execute normal and export searches
- Get search results, job status and search job properties.
Module 6 – Advanced Searching and Job Management
- Execute a real time search
- Work with saved searches
- Manage search jobs
Module 7 – Working with the KV Store
- Define the function of a KV Store
- Define collections and records
- Perform CRUD operations on collections and records
Module 8 – Using the HTTP Event Collector (HEC)
- Create and use HEC tokens
- Input data using HEC endpoints
- Get indexer event acknowledgements
