https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220423#M24112 <P>Thanks. So the problem was the default python was 2.6. Once I pointed /usr/bin/python 2.7 I got it to work. Thanks!</P> Sun, 08 Jan 2017 02:54:47 GMT burwell 2017-01-08T02:54:47Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220419#M24108 <P>I am using REST API Modular Input to sample Twitter per <A href="http://blogs.splunk.com/2014/07/03/splunking-social-media-tracking-tweets/">http://blogs.splunk.com/2014/07/03/splunking-social-media-tracking-tweets/</A> on a Standalone Search Head. It all works great.</P> <P>How would I configure this on a search head cluster? Would I add inputs.conf on each Search Head in my cluster? How would we be sure each head didn't run the rest command but the results would be available across all heads.</P> <P>The inputs.conf has the stanza</P> <PRE><CODE> [rest://TwitterFeed] </CODE></PRE> Thu, 05 Jan 2017 19:10:56 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220419#M24108 burwell 2017-01-05T19:10:56Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220420#M24109 <P>In a distributed architecture you should install the App on a Forwarder and edit inputs.conf directly rather than using the config UI.</P> Fri, 06 Jan 2017 06:44:54 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220420#M24109 Damien_Dallimor 2017-01-06T06:44:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220421#M24110 <P>So I tried on a forwarder but was getting odd python errors. Does the REST API Modular Input have to be on a full Splunk install or will a splunk forwarder install suffice?</P> Sat, 07 Jan 2017 02:35:05 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220421#M24110 burwell 2017-01-07T02:35:05Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220422#M24111 <P>"...Unlike full Splunk Enterprise, the universal forwarder does not include a bundled version of Python...."</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Typesofforwarders#The_universal_forwarder">http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Typesofforwarders#The_universal_forwarder</A></P> <P>UF's need a python runtime on the OS.<BR /> Heavy Forwaders do not.</P> Sat, 07 Jan 2017 04:14:36 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220422#M24111 Damien_Dallimor 2017-01-07T04:14:36Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220423#M24112 <P>Thanks. So the problem was the default python was 2.6. Once I pointed /usr/bin/python 2.7 I got it to work. Thanks!</P> Sun, 08 Jan 2017 02:54:47 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220423#M24112 burwell 2017-01-08T02:54:47Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220424#M24113 <P>Is there a way to have high availability for the REST Modular Input(without resorting to a load balancer)? What if the standalone search head/forwarder goes down? </P> Fri, 14 Dec 2018 03:10:52 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-REST-API-Modular-Input-with-Search-Head-Cluster/m-p/220424#M24113 matthewroberson 2018-12-14T03:10:52Z