They say a picture is worth 1000 words. Actually it’s far more than that.
Take an Instagram image, there is tons of useful metadata behind the image – not just that tasty picture of what you had for dinner last night.
But how do you start to look at this data? I think you already know the answer to that! This post is just a quick guide showing you how to ingest and visualise Instagram data in Splunk.
- A basic understanding of Splunk
- Splunk installed and running (free download here)
- An Instagram account
Step 1: Create an Instagram App
Once in, select: “Register Your Application”.
Select: “Register New Application”.
Choose your application name, give it a description, add a website URL, and a callback URI – then hit “Register”.
Note, for website URL & callback URI you can use any domain of your choice as we will not these for the Splunk configuration.
Important: We will use implicit authentication between Splunk and the Instagram API. By default Instagram will disable implicit oAuth under the security tab. Uncheck the “Disable implicit OAuth” option.
Step 2: Generate access token
You will see Instagram has now created a new app (client) with a client ID and client secret. All we need now is an access token.
To do this you need to make a request to Instagram using the client ID and redirect URI of your app. Replace the values in the URL below, and then enter it into a browser address bar:
https://instagram.com/oauth/authorize/?client_id=CLIENT-ID redirect_uri=REDIRECT-URI response_type=token
At this point, you will be presented with a login screen (login with you Instagram account) and then a confirmation screen where you will approve your apps access to your Instagram account.
Once you have authenticated and authorised your application, you’ll be redirected to the redirect URI with the access_token now in the URL. It’ll look something like:
Copy the access token from the URL into a text editor to store for the moment.
Step 3: Install REST Modular Input
We’ll also need to add an response handler to the REST API Modular Input to manage the feed from Instagram. To do this open the following file:
“$splunkhome > etc > apps > rest_ta > bin > reponsehandler.py”
And finally paste the code you’ve just copied above the line “#HELPER FUNCTIONS” in “responsehandler.py”.
Now save this file and restart Splunk.
Step 4: Configure a Splunk Input
For the following we will use the users endpoint. This pulls back data from a specific Instagram users feed (only if it’s public).
2 points to note:
- the Instagram API requires the users ID, not username. For instance, @splunk = 2031602277. Find an ID here.
- you also need to specify the earliest photo to return in the request using a media ID (for instance, the first photo that user owns). To do this navigate to the users first image, i.e https://instagram.com/p/1l9wtZI5h6/. Then paste this page URL onto the end of this URL and hit enter: http://api.instagram.com/oembed?url=<FULL IMAGE URL>. Find media_id= in the returned page and copy the value. It will look something like: 965449323253045370_2031602277
There are a number of endpoints you can poll to retrieve images using other variables, for example tags, you can read more about them here.
Back to the example for the users endpoint, in Splunk navigate to “Settings > Data Inputs > REST”, and select “Add new”.
As a minimum, add the following to an input:
Name: <MY USER INPUT>
Endpoint URL: https://api.instagram.com/v1/users/<YOUR USER ID>/media/recent
HTTP Method: GET
Authentication type: OAUTH 2
OAUTH2 Access token: <generated during step 2
OAUTH2 Client ID: <generated during step 2>
OAUTH2 Client secret: <generated during step 2>
URL Arguments: min_id=965449323253045370_2031602277,access_token=<generated during step 2>,min_timestamp=0
Response Handler: InstagramUserFeedEventHandler
Response type: JSON
Backoff time: 300
Polling interval: 300
Now click “Save”. Don’t forget to enable the input once you’ve saved it.
Step 5: Make it Look Good
Remember to post your #splunk images to Instagram – we’re Splunking you!