topic passing multivalue arguments rest_ta inputs in All Apps and Add-ons

passing multivalue arguments rest_ta inputs

pmeyerson — Tue, 29 Sep 2020 17:20:23 GMT

I am trying out the rest_ta and having an issue trying to use a GET request with a multi-value argument.
The argument I want to pass is, "return_fields=comment,network"
I tried escaping with " or ', and also tried passing return_fields twice, one for each argument value. The first value was then dropped.

If I try to use "return_fields=comment,network" as either an url argument or http header property, I get the below error:

12-20-2017 17:17:12.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" http_header_propertys = dict((k.strip(), v.strip()) for k,v in
12-20-2017 17:17:12.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" ValueError: need more than 1 value to unpack

Can anyone point me in the right direction here? Is there some different escape format or do I need to head down a different direction? Appreciate any suggestions - just getting started with rest calls.

Re: passing multivalue arguments rest_ta inputs

Damien_Dallimor — Thu, 21 Dec 2017 06:05:57 GMT

For return_fields=comment,network

change the delimiter to something other than a comma , such as a colon

Re: passing multivalue arguments rest_ta inputs

nikita_p — Thu, 21 Dec 2017 06:44:11 GMT

Hi Pmeyerson,
Can you check below splunk docs for return command if it helps?
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Return

Re: passing multivalue arguments rest_ta inputs

pmeyerson — Thu, 21 Dec 2017 14:30:26 GMT

thanks, I misread the input page and didn't understand that, thanks!