<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Rest API Modular Input: How to debug/params not working in All Apps and Add-ons</title>
    <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Rest-API-Modular-Input-How-to-debug-params-not-working/m-p/455080#M56005</link>
    <description>&lt;P&gt;Info on our community support here : &lt;A href="https://www.baboonbones.com/#support"&gt;https://www.baboonbones.com/#support&lt;/A&gt;&lt;/P&gt;</description>
    <pubDate>Thu, 07 Feb 2019 02:48:47 GMT</pubDate>
    <dc:creator>baboonbones</dc:creator>
    <dc:date>2019-02-07T02:48:47Z</dc:date>
    <item>
      <title>Rest API Modular Input: How to debug/params not working</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Rest-API-Modular-Input-How-to-debug-params-not-working/m-p/455079#M56004</link>
      <description>&lt;P&gt;Edit: I originally had been parsing "Connections_incoming.txt", but it was coming in 6 hours late (due to UTC). Even after setting it in props, it still comes in late. Personally, I'm fine with using this method as it includes more data.&lt;/P&gt;

&lt;P&gt;I'm unable to figure out why the REST app is pulling more results than it should. I'm accessing the Teamviewer API.&lt;/P&gt;

&lt;P&gt;Docs: &lt;A href="https://dl.tvcdn.de/integrate/TeamViewer_API_Documentation.pdf"&gt;https://dl.tvcdn.de/integrate/TeamViewer_API_Documentation.pdf&lt;/A&gt;&lt;/P&gt;

&lt;P&gt;Timestamps are in UTC. I've created tokens and they seem to be working.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;import datetime

def datetoday():
      today = datetime.date.today()
      return today.strftime('%Y-%m-%d')

def timemfive():
      utcoffset = datetime.timedelta(hours=6)
      fivemins = datetime.timedelta(minutes=5)
      now = (datetime.datetime.now() + utcoffset)
      timemfive = now - fivemins
      return timemfive.strftime('%Y-%m-%dT%H:%M:%SZ')

def timenow():
      utcoffset = datetime.timedelta(hours=6)
      now = (datetime.datetime.now() + utcoffset)
      return now.strftime('%Y-%m-%dT%H:%M:%SZ')
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;UL&gt;
&lt;LI&gt;Endpoint I'm calling: &lt;A href="https://webapi.teamviewer.com/api/v1/reports/connections?from_date=$timemfive$"&gt;https://webapi.teamviewer.com/api/v1/reports/connections?from_date=$timemfive$&lt;/A&gt;&lt;/LI&gt;
&lt;LI&gt;Polls every 300 seconds.&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;The issue is, I'm getting more than 5 minutes of reports. It seems up to an hour. If I call a similar URL (via Postman), I get the intended results. So what I want to see now is the actual URL the app calls. Is that logged somewhere?&lt;/P&gt;

&lt;P&gt;I'm also seeing the following:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;DateParserVerbose - A possible timestamp match (Mon Jan  1 16:16:40 2007) is outside of the acceptable time window.
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Can this cause problems, or is it simply notifying me? What's strange is the year appears to be in the past. I've tested both these functions with Python itself, and it outputs as expected.&lt;/P&gt;</description>
      <pubDate>Wed, 06 Feb 2019 21:21:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Rest-API-Modular-Input-How-to-debug-params-not-working/m-p/455079#M56004</guid>
      <dc:creator>tmontney</dc:creator>
      <dc:date>2019-02-06T21:21:56Z</dc:date>
    </item>
    <item>
      <title>Re: Rest API Modular Input: How to debug/params not working</title>
      <link>https://community.splunk.com/t5/All-Apps-and-Add-ons/Rest-API-Modular-Input-How-to-debug-params-not-working/m-p/455080#M56005</link>
      <description>&lt;P&gt;Info on our community support here : &lt;A href="https://www.baboonbones.com/#support"&gt;https://www.baboonbones.com/#support&lt;/A&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 07 Feb 2019 02:48:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/All-Apps-and-Add-ons/Rest-API-Modular-Input-How-to-debug-params-not-working/m-p/455080#M56005</guid>
      <dc:creator>baboonbones</dc:creator>
      <dc:date>2019-02-07T02:48:47Z</dc:date>
    </item>
  </channel>
</rss>

