Splunk KV Store REST Python Example

# http://docs.python-requests.org/en/latest/index.html
# http://isbullsh.it/2012/06/Rest-api-in-python/
# http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

import requests, json
import sys

# Sadly due to the Splunk certs containing a password we need to disable warnings
requests.packages.urllib3.disable_warnings()

# One possible way to use certs for warnings but you cannot pass the password for the cert so it's close but not quite there
# SplunkCert = '/opt/splunk/etc/auth/server.pem'
# SpunkCertKey = 'password'
#r = requests.delete(splunkURI, auth=(splunkUser, splunkPwd), verify=False, headers=headers, cert=(SplunkCert)

splunkApp = "cwe_test"
splunkUser = "admin"
splunkPwd = "changeme"
splunkURI = "https://localhost:8089/servicesNS/nobody/%s/storage/collections/data" % splunkApp
KV_Store = "cve_test"
# KV_Store = "json_features"

# Curl Example
# curl -k -u admin:changeme  https://localhost:8089/servicesNS/nobody/nvd_datafeeds/storage/collections/data/cve_database  -H "Content-Type: application/json" -d '{"cve":"test","cwe":"test","score":"here","datePublished":"test","dateModified":"test","accessVector":"test","summary":"test"}'


# DELETE Data we just added above
print "\n************** DELETE ENTIRE KV STORE EXAMPLE ****************"

if True == True:
    kvURI = "%s/%s" % (splunkURI, KV_Store)
    headers = {'Content-Type': 'application/json'}
    r = requests.delete(kvURI, auth=(splunkUser, splunkPwd), verify=False, headers=headers)

    print 'Status Code %d' % r.status_code
    # print r.json
    print r.text

# sys.exit()

# INSERT Data
print "\n************** INSERT EXAMPLE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
data = json.dumps({"cve":"test","cwe":"test","score":3,"datePublished":"20150617","dateModified":"20150621","accessVector":"test","summary":"A test record","multivalue":["theFirst","theSecond"]})
r = requests.post(kvURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)

# INSERT Data
print "\n************** INSERT EXAMPLE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
data = json.dumps({"cve":"anothertest","cwe":"test","score":5,"datePublished":"20150618","dateModified":"20150623","accessVector":"yours","summary":"The other test record","multivalue":["theFirst","theSecond"]})
r = requests.post(kvURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)



# QUERY COLLECTION
print "\n************** QUERY EXAMPLE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
data = {"limit":4}
r = requests.get(kvURI, data, auth=(splunkUser, splunkPwd), verify=False)

print 'Status Code %d' % r.status_code
# print r.json
print r.text


# INSERT Data
print "\n************** INSERT EXAMPLE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
data = json.dumps({"cve":"test","cwe":"test","score":"that","datePublished":"test","dateModified":"test","accessVector":"test","summary":"test","multivalue":["theFirst","theSecond"]})
r = requests.post(kvURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)


print 'Status Code %d' % r.status_code
if r.status_code == 201:
    # print r.json
    print r.text

    # load up data into json
    myData = json.loads(r.text)
    print 'The key is - %s' % myData['_key']

    # DELETE Data we just added above
    print "\n************** DELETE SINGLE EXAMPLE ****************"

    kvURI = "%s/%s/%s" % (splunkURI, KV_Store, myData['_key'])
    headers = {'Content-Type': 'application/json'}
    r = requests.delete(kvURI, auth=(splunkUser, splunkPwd), verify=False, headers=headers)

    print 'Status Code %d' % r.status_code
    # print r.json
    print r.text


# QUERY COLLECTION
print "\n************** QUERY WITH SEARCH EXAMPLE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
query = {"score":3}
# query = {"score":{"$ne":"that"}}
data = json.dumps({"query":query})
data = {"limit":1, "query":json.dumps(query)}
r = requests.get(kvURI, data, auth=(splunkUser, splunkPwd), verify=False)

print 'Status Code %d' % r.status_code
print r.json
print r
contents = json.loads(r.text)
print len(contents)
print contents
print contents[0]['_key']




# INSERT Data
print "\n************** INSERT EXAMPLE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
data = json.dumps({"cve":"aSpecificTest","cwe":"query-delete","score":3,"datePublished":"20150617","dateModified":"20150621","accessVector":"test","summary":"A test record","multivalue":["theFirst","theSecond"]})
r = requests.post(kvURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)

# INSERT Data
print "\n************** INSERT EXAMPLE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
data = json.dumps({"cve":"theTestMarkedForDeletion","cwe":"query-delete","score":5,"datePublished":"20150618","dateModified":"20150623","accessVector":"yours","summary":"The other test record","multivalue":["theFirst","theSecond"]})
r = requests.post(kvURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)

# INSERT Batch Data
print "\n************** BATCH INSERT EXAMPLE ****************"

kvURI = "%s/%s/batch_save" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
data = json.dumps([{"cve":"aBatchExample1","cwe":"query-batch-test","score":5,"datePublished":"20150618","dateModified":"20150623","accessVector":"yours","summary":"The other test record","multivalue":["theFirst","theSecond"]},{"cve":"aBatchExample2","cwe":"query-batch-test","score":5,"datePublished":"20150618","dateModified":"20150623","accessVector":"yours","summary":"The other test record","multivalue":["theFirst","theSecond"]},{"cve":"aBatchExample3","cwe":"query-batch-test","score":5,"datePublished":"20150618","dateModified":"20150623","accessVector":"yours","summary":"The other test record","multivalue":["theFirst","theSecond"]}])
r = requests.post(kvURI, data, auth=(splunkUser, splunkPwd), verify=False, headers=headers)




#  QUERY COLLECTION
print "\n************** SEARCH BEFORE DELETE ****************"

# another way of adding a query (important for the delete method coming up)
kvURI = "%s/%s?query=%s" % (splunkURI, KV_Store,json.dumps({"cwe":"query-delete"}))
headers = {'Content-Type': 'application/json'}
r = requests.get(kvURI, auth=(splunkUser, splunkPwd), verify=False)

print 'Status Code %d' % r.status_code
print r.json
print r
contents = json.loads(r.text)
print len(contents)
print contents
print contents[0]['_key']

# DELETE QUERY COLLECTION
print "\n************** DELETE WITH SEARCH EXAMPLE ****************"

# As you cannot pass a query to the delete we must pass it in the URI
kvURI = "%s/%s?query=%s" % (splunkURI, KV_Store,json.dumps({"cve":"theTestMarkedForDeletion"}))
headers = {'Content-Type': 'application/json'}
r = requests.delete(kvURI, auth=(splunkUser, splunkPwd), verify=False)

print 'Status Code %d' % r.status_code
print r.json
print r

#  QUERY COLLECTION
print "\n************** SEARCH AFTER DELETE ****************"

kvURI = "%s/%s" % (splunkURI, KV_Store)
headers = {'Content-Type': 'application/json'}
data = {"query":json.dumps({"cwe":"query-delete"})}
r = requests.get(kvURI, data, auth=(splunkUser, splunkPwd), verify=False)

print 'Status Code %d' % r.status_code
print r.json
print r
contents = json.loads(r.text)
print len(contents)
print contents
print contents[0]['_key']