Skip to main content

Export data via REST API

  • Updated
Print Friendly and PDF

Create Token

Open Settings -> Tokens and press New Token

Fill out the questions and press "Create".

  • User: uxmapp_wsgi
  • Audience: Export of UXM data
  • Expiry date: +3y

Copy the generated token code and save it, needs to be added to the custom powershell.

 

mceclip3.png

 

Ensure REST service port is accessible

By default Splunk hosts it's REST API on port 8089, this port can be opened up or a reverse proxy can be setup to forward the data to the local port.

UXM Cloud: Please contact us to get the reverse proxy set

NGINX reverse proxy example that only expose the searches from uxmapp:

    location /servicesNS/nobody/uxmapp/search/jobs/export {
        proxy_pass_request_headers on;
        proxy_set_header x-real-IP $remote_addr;
        proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
        proxy_set_header host $host;
        proxy_pass https://10.132.0.66:8089/servicesNS/nobody/uxmapp/search/jobs/export;
    }

 

Create report

Goto Settings -> "Searches, reports and alerts", Create new report or enable one of the existing "Export - *" reports.

mceclip1.png

Example SPL to query endpoint nodes and scores, union has been used to merge KVStore and Metric Store data. (join is avoided because it's limited to 50.000 rows)

| union
[| inputlookup ux_nodes_lookup | fields *]
[| mstats latest(uxm.endpoint.score.avg) AS score_avg, latest(uxm.endpoint.score.latency) AS score_latency, latest(uxm.endpoint.score.processor_time) AS score_cpu, latest(uxm.endpoint.score.memory_usage) AS score_memory_usage, latest(uxm.endpoint.score.disk_os_usage) AS score_disk_os_usage, latest(uxm.endpoint.score.logon_duration) AS score_logon_duration
WHERE `getIndexMetrics` BY lookup_key ]
| stats last(active_user) AS "active_user",last(active_username) AS "active_username",last(batteries) AS "batteries",last(battery_device_name) AS "battery_device_name",last(battery_manufacturer_name) AS "battery_manufacturer_name",last(battery_serial_number) AS "battery_serial_number",last(battery_wear_level) AS "battery_wear_level",last(browsers) AS "browsers",last(chassis_sku_number) AS "chassis_sku_number",last(city) AS "city",last(connection_type) AS "connection_type",last(country) AS "country",last(country_name) AS "country_name",last(cpu_clock_frequency) AS "cpu_clock_frequency",last(cpu_cores) AS "cpu_cores",last(cpu_generation) AS "cpu_generation",last(cpu_logical_processors) AS "cpu_logical_processors",last(cpu_model) AS "cpu_model",last(cpu_sockets) AS "cpu_sockets",last(dns) AS "dns",last(domain) AS "domain",last(enabled) AS "enabled",last(hostname) AS "hostname",last(identifying_number) AS "identifying_number",last(internal_ip) AS "internal_ip",last(internal_mac_address) AS "internal_mac_address",last(is_64bit) AS "is_64bit",last(last_boottime) AS "last_boottime",last(last_logon) AS "last_logon",last(last_registration) AS "last_registration",last(location) AS "location",last(log_files_requested) AS "log_files_requested",last(machine_uuid) AS "machine_uuid",last(manufacturer) AS "manufacturer",last(memory_mb) AS "memory_mb",last(model) AS "model",last(os) AS "os",last(os_codename) AS "os_codename",last(os_edition) AS "os_edition",last(os_service_pack) AS "os_service_pack",last(os_version) AS "os_version",last(powerplan) AS "powerplan",last(powerplan_description) AS "powerplan_description",last(powerplan_instance_id) AS "powerplan_instance_id",last(product_caption) AS "product_caption",last(product_name) AS "product_name",last(product_uuid) AS "product_uuid",last(product_version) AS "product_version",last(proxy) AS "proxy",last(public_ip) AS "public_ip",last(release_id) AS "release_id",last(tags) AS "tags",last(type) AS "type",last(vendor) AS "vendor",last(version) AS "version",last(warranty_end) AS "warranty_end",last(warranty_start) AS warranty_start, avg(score_avg) AS score_avg, avg(score_cpu) AS score_cpu, avg(score_memory_usage) AS score_memory_usage, avg(score_disk_os_usage) AS score_disk_os_usage, avg(score_logon_duration) AS score_logon_duration by lookup_key
| fillnull value=10 score_avg

 

Powershell example to fetch data

Create file export_endpoint_info.ps1 and add the following code:

Update values:

  • server: Server to query data from
  • searchName: Saved search to execute and return data from.
  • token: Token created in the begining of this guide.
# This will allow for self-signed SSL certs to work
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

$server = "customername.uxmapp.com"
$searchName = "Export - Endpoint nodes"
$appName = "uxmapp"
$token = "eyJraWQ...OYmg"
$headers = @{
    Authorization="Bearer $token"
}

$url = "https://${server}/servicesNS/nobody/$appName/search/jobs/export"
$search = "| savedsearch ""$searchName"""
Write-Host "Fetching data from $url"

$body = @{
    search = $search
    output_mode = "csv" # json or csv
    earliest_time = "-7d@d"
    latest_time = "now"
}

Invoke-RestMethod -ContentType application/json -Method Post -Uri $url -Body $body -Headers $headers -TimeoutSec 60

 

Related articles

On this page