<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data? in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134636#M11240</link>
    <description>&lt;P&gt;You could set up a transforms.conf rule that routes empty events to the &lt;CODE&gt;nullQueue&lt;/CODE&gt;.&lt;/P&gt;</description>
    <pubDate>Wed, 03 Dec 2014 19:29:47 GMT</pubDate>
    <dc:creator>martin_mueller</dc:creator>
    <dc:date>2014-12-03T19:29:47Z</dc:date>
    <item>
      <title>REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134631#M11235</link>
      <description>&lt;P&gt;Hello&lt;/P&gt;

&lt;P&gt;I am new to writing Rest APi calls so please pardon my ignorance if its really simple. I wrote a rest api call which talks to cloudera and gets the events. This part works fine. The issue is it polls every 60sec( default) as I am using the Rest API Modular Input and it pulls all data instead of getting just the new events which happened. &lt;/P&gt;

&lt;P&gt;Is there a way to tell a REST api call to get only new events? I know that I can have the time in the URL argument which will then keep data limited to only that time, but how to I dynamically change that date time value so that it automatically pulls newer data?&lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 16:18:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134631#M11235</guid>
      <dc:creator>theouhuios</dc:creator>
      <dc:date>2014-11-25T16:18:40Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134632#M11236</link>
      <description>&lt;P&gt;If you're on version 1.3.5 then the date token used in the URL should update itself for every call. If you need more tokens you can add them yourself.&lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 18:12:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134632#M11236</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-11-25T18:12:40Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134633#M11237</link>
      <description>&lt;P&gt;But it only gets the date but not the time right? Each time it runs its getting everything for today instead of getting only the changes which happened. &lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 20:06:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134633#M11237</guid>
      <dc:creator>theouhuios</dc:creator>
      <dc:date>2014-11-25T20:06:31Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134634#M11238</link>
      <description>&lt;P&gt;The example token only gives you the date, but you can add any tokens to the app you need.&lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 20:13:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134634#M11238</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-11-25T20:13:22Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134635#M11239</link>
      <description>&lt;P&gt;When I place a datetime as a token it gets empty events which is actually right. But is it possible to not index the json data if there is no value in the items ?&lt;/P&gt;</description>
      <pubDate>Wed, 03 Dec 2014 16:27:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134635#M11239</guid>
      <dc:creator>theouhuios</dc:creator>
      <dc:date>2014-12-03T16:27:05Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134636#M11240</link>
      <description>&lt;P&gt;You could set up a transforms.conf rule that routes empty events to the &lt;CODE&gt;nullQueue&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Wed, 03 Dec 2014 19:29:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134636#M11240</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-12-03T19:29:47Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134637#M11241</link>
      <description>&lt;P&gt;Yeah, did the same. I was thinking if I could do it in the input itself, but since that didn't work used the transforms&lt;/P&gt;</description>
      <pubDate>Thu, 04 Dec 2014 13:02:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134637#M11241</guid>
      <dc:creator>theouhuios</dc:creator>
      <dc:date>2014-12-04T13:02:18Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134638#M11242</link>
      <description>&lt;P&gt;Does that answer your original question?&lt;/P&gt;</description>
      <pubDate>Thu, 04 Dec 2014 18:01:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134638#M11242</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-12-04T18:01:31Z</dc:date>
    </item>
    <item>
      <title>Re: REST API Modular Input: Is there a way to have a REST API call retrieve only new events, not all data?</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134639#M11243</link>
      <description>&lt;P&gt;Yup. Thanks Martin&lt;/P&gt;</description>
      <pubDate>Thu, 04 Dec 2014 20:07:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/REST-API-Modular-Input-Is-there-a-way-to-have-a-REST-API-call/m-p/134639#M11243</guid>
      <dc:creator>theouhuios</dc:creator>
      <dc:date>2014-12-04T20:07:29Z</dc:date>
    </item>
  </channel>
</rss>

