topic Re: Why does configuring a Response Handler in the REST API Modular Input break polling? in All Apps and Add-ons

Why does configuring a Response Handler in the REST API Modular Input break polling?

mlcooper7 — Sat, 10 Dec 2016 18:23:21 GMT

I am trying to ingest some JSON from a REST endpoint that is an array in the form:

My goal is to make each element in the array a separate event in Splunk.

When I configure the REST API Modular Input endpoint with JSONArrayHandler for the Response Handler, it seems that polling breaks. I tail -f /opt/splunk/var/log/splunk/splunkd.log but it does not seem to ever poll. If I remove JSONArrayHandler from the Response Handler configuration, it does poll.

Config:

I am using https://splunkbase.splunk.com/app/1546/ version 1.4 and splunk enterprise 6.5.1.

Why does polling stop if I configure JSONArrayHandler for the Response Handler?

Re: Why does configuring a Response Handler in the REST API Modular Input break polling?

Damien_Dallimor — Sun, 11 Dec 2016 02:37:03 GMT

Have you tried creating your own custom handler that is actually specific to your JSON format ?

Re: Why does configuring a Response Handler in the REST API Modular Input break polling?

mlcooper7 — Sun, 11 Dec 2016 02:51:01 GMT

I have not, no. I was under the impression that JSONArrayHandler would perhaps automatically make each item in the array a separate event in splunk. I read through the code for it, but unfortunately I can only read so much python. I could perhaps devise one if I saw an example of some JSON with its custom handler. I could probably manipulate it to fit the format of the JSON I'm working with.

Re: Why does configuring a Response Handler in the REST API Modular Input break polling?

mlcooper7 — Sun, 11 Dec 2016 02:56:32 GMT

I'm not able to share my JSON due to its somewhat sensitive nature, however the FlightInfo example looks like it might sort of translate to the format of my JSON.

https://answers.splunk.com/answers/240659/how-to-troubleshoot-why-rest-api-modular-input-sto.html

Re: Why does configuring a Response Handler in the REST API Modular Input break polling?

mlcooper7 — Sun, 11 Dec 2016 03:11:15 GMT

That worked! Each of the elements in my JSON is now a separate event in splunk. Thanks!