TIPS & TRICKS

Instasplunk

Splunk By Splunk May 15, 2015

Splunk Instagram

They say a picture is worth 1000 words. Actually it’s far more than that.

Take an Instagram image, there is tons of useful metadata behind the image – not just that tasty picture of what you had for dinner last night.

But how do you start to look at this data? I think you already know the answer to that! This post is just a quick guide showing you how to ingest and visualise Instagram data in Splunk.

Prerequisites

For this walkthrough I’ll use the @Splunk Instagram account to collect images from. We like taking photos of ponies.

Step 1: Create an Instagram App

First, sign into the Instagram developer portal using your normal Instagram account account here.

Once in, select: “Register Your Application”.

Select: “Register New Application”.

Choose your application name, give it a description, add a website URL, and a callback URI – then hit “Register”.

Note, for website URL & callback URI you can use any domain of your choice as we will not these for the Splunk configuration.

Important: We will use implicit authentication between Splunk and the Instagram API. By default Instagram will disable implicit oAuth under the security tab. Uncheck the “Disable implicit OAuth” option.

Step 2: Generate access token

Instagram Auth

You will see Instagram has now created a new app (client) with a client ID and client secret. All we need now is an access token.

To do this you need to make a request to Instagram using the client ID and redirect URI of your app. Replace the values in the URL below, and then enter it into a browser address bar:

https://instagram.com/oauth/authorize/?client_id=CLIENT-ID redirect_uri=REDIRECT-URI response_type=token

At this point, you will be presented with a login screen (login with you Instagram account) and then a confirmation screen where you will approve your apps access to your Instagram account.

Once you have authenticated and authorised your application, you’ll be redirected to the redirect URI with the access_token now in the URL. It’ll look something like:

http://your-redirect-uri#access_token=ACCESS-TOKEN

Copy the access token from the URL into a text editor to store for the moment.

You can read more about authentication in the Instagram docs.

Step 3: Install REST Modular Input

To get this feed into Splunk we’ll use Damien Dallimore’s REST API Modular input for Splunk. You can download the app here with full instructions on how to install it.

We’ll also need to add an response handler to the REST API Modular Input to manage the feed from Instagram. To do this open the following file:

“$splunkhome > etc > apps > rest_ta > bin > reponsehandler.py”

Then copy this code.

And finally paste the code you’ve just copied above the line “#HELPER FUNCTIONS” in “responsehandler.py”.

Now save this file and restart Splunk.

Step 4: Configure a Splunk Input

Splunk Instagram Input

For the following we will use the users endpoint. This pulls back data from a specific Instagram users feed (only if it’s public).

2 points to note:

  • the Instagram API requires the users ID, not username. For instance, @splunk = 2031602277. Find an ID here.
  • you also need to specify the earliest photo to return in the request using a media ID (for instance, the first photo that user owns). To do this navigate to the users first image, i.e https://instagram.com/p/1l9wtZI5h6/. Then paste this page URL onto the end of this URL and hit enter: http://api.instagram.com/oembed?url=<FULL IMAGE URL>. Find media_id= in the returned page and copy the value. It will look something like: 965449323253045370_2031602277

There are a number of endpoints you can poll to retrieve images using other variables, for example tags, you can read more about them here.

Back to the example for the users endpoint, in Splunk navigate to “Settings > Data Inputs > REST”, and select “Add new”.

As a minimum, add the following to an input:

Name: <MY USER INPUT>
Endpoint URL: https://api.instagram.com/v1/users/<YOUR USER ID>/media/recent
HTTP Method: GET
Authentication type: OAUTH 2
OAUTH2 Access token: <generated during step 2
OAUTH2 Client ID: <generated during step 2>
OAUTH2 Client secret: <generated during step 2>
URL Arguments: min_id=965449323253045370_2031602277,access_token=<generated during step 2>,min_timestamp=0
Response Handler: InstagramUserFeedEventHandler
Response type: JSON
Backoff time: 300
Polling interval: 300

Now click “Save”. Don’t forget to enable the input once you’ve saved it.

Step 5: Make it Look Good

Instagram Splunk

To help you get started visualising this data, Johan Bjerke has developed a great Splunk app for Instagram. Both screenshots in the post showcase it. Download it on Splunkbase.

Remember to post your #splunk images to Instagram – we’re Splunking you!

----------------------------------------------------
Thanks!
David Greenwood

Splunk
Posted by

Splunk