Пример команды скручивания: curl "https://www.test.org: 8088 / services / collector / raw " -kH "Авторизация: Splunk 999" -d '{"index": "ab c", "sourcetype": "dev" , "Username": "user1", "lastActiveDate": +1236472051,807}» Выпуск: 1. Когда даны данные = строка теста (введенное вручную значение), он работает нормально. 2. Но когда задан data = completeinfowithsyntax, он не может отправить данные.
Python Программа:
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
import calendar, time
from datetime import datetime
import re
import json
def convert_utc_to_epoch(lastActiveDate):
timestamp = datetime.strptime(lastActiveDate, "%Y-%m-%dT%H:%M:%S.000+0000")
epoch = int(calendar.timegm(timestamp.utctimetuple()))
return epoch
def getInfo():
headers = {
'Authorization': 'adc 12345'
'Content-Type': 'application/json',
}
userName_list , lastActiveDate_list = [] , []
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
response = requests.get('https://somewebsite.org', headers=headers, verify=False)
Content = response.text
userName = re.compile(r'.*"userName":"(.*?)"')
userName_list = (userName.findall(Content)) if userName else ""
lastActiveDate = re.compile(r'.*"lastActiveDate":"(.*?)"')
lastActiveDate_list = (lastActiveDate.findall(Content)) if lastActiveDate else ""
lastActiveDate = convert_utc_to_epoch(lastActiveDate_list[0])
return userName_list[0],lastActiveDate
def sendDataToSplunk():
headers = {
'Authorization': 'Splunk 999',
}
RequiredData = getInfo()
print(RequiredData)
timeinttostr= str(RequiredData[1])
completeinfo='"index":"abc","sourcetype":"dev","userName":"'+RequiredData[0]+'","lastActiveDate":'+timeinttostr
print(completeinfo)
completeinfowithsyntax="'{"+completeinfo+"}'"
print(type(completeinfowithsyntax))
print("completeinfowithsyntax",completeinfowithsyntax)
teststring='{"index":"abc","sourcetype":"dev","userName":"user1","lastActiveDate":1579010706}'
response = requests.post('https://www.test.org:8088/services/collector/raw', headers=headers, data=completeinfowithsyntax, verify=False)
print("done")
sendDataToSplunk()