https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134436#M11210 <P>Are you possibly trying to re-create threatlist data sources?</P> Tue, 21 Jul 2015 17:48:43 GMT martin_mueller 2015-07-21T17:48:43Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134435#M11209 <P>I understand how the REST API works but I am lazy by default and have no intentions for creating over 1000 inputs. I want to use this http get <CODE><A href="https://www.badips.com/get/info/61.160.212.66" target="test_blank">https://www.badips.com/get/info/61.160.212.66</A></CODE>, to get info on a IP Address (61.160.212.66 is just an example IP Address). Is there a way for me to have IP Addresses saved on a csv file and then substitute the current ip address in the url with the csv file ip address. Therefore I can stream ip address info bout all of the ip address.Can this be done in input config is there a better of approaching this. </P> Tue, 21 Jul 2015 17:28:08 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134435#M11209 syx093 2015-07-21T17:28:08Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134436#M11210 <P>Are you possibly trying to re-create threatlist data sources?</P> Tue, 21 Jul 2015 17:48:43 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134436#M11210 martin_mueller 2015-07-21T17:48:43Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134437#M11211 <P>In a way, yes.</P> Tue, 21 Jul 2015 17:52:41 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134437#M11211 syx093 2015-07-21T17:52:41Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134438#M11212 <P>You may want to build a streaming command using the SDK.</P> Tue, 21 Jul 2015 19:05:42 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134438#M11212 bmacias84 2015-07-21T19:05:42Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134439#M11213 <P>The SDK for Splunk? </P> Tue, 21 Jul 2015 19:12:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134439#M11213 syx093 2015-07-21T19:12:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134440#M11214 <P>Consider looking at existing threatlist input implementations instead of re-inventing the wheel.</P> Tue, 21 Jul 2015 20:34:18 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134440#M11214 martin_mueller 2015-07-21T20:34:18Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134441#M11215 <P>The REST API Modular input supports tokenization in the endpoint URL.</P> <P>You can setup 1 single input and then parametize the URL with a token definition.</P> <P>This token definition is a function in <STRONG>rest_ta/bin/tokens.py</STRONG> that you would write to return a list of IP addresses.</P> <P>This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/485iE26B70C03BA1F70F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/486iAA3393240A800159/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 22 Jul 2015 04:50:14 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134441#M11215 Damien_Dallimor 2015-07-22T04:50:14Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134442#M11216 <P>Do you have any recommendations. </P> Wed, 22 Jul 2015 12:24:18 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134442#M11216 syx093 2015-07-22T12:24:18Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134443#M11217 <P>This might be a start: <A href="https://splunkbase.splunk.com/apps/#/order/relevance/search/threat%2520list">https://splunkbase.splunk.com/apps/#/order/relevance/search/threat%2520list</A></P> Wed, 22 Jul 2015 20:05:06 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134443#M11217 martin_mueller 2015-07-22T20:05:06Z https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134444#M11218 <P>Thank you very much</P> Wed, 22 Jul 2015 20:12:14 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/What-is-the-best-way-to-use-the-REST-API-to-get-info-from-almost/m-p/134444#M11218 syx093 2015-07-22T20:12:14Z