topic Re: Possible to ingest REST API JSON data with splunk initiating poll? in All Apps and Add-ons

Possible to ingest REST API JSON data with splunk initiating poll?

pir8radio — Thu, 23 Apr 2020 20:44:45 GMT

I want splunk to reach out to a few goofy devices on my network and grab JSON responses. Is this possible? can I get a few examples?

So to be clear i would like splunk to poll (reach out) say http://dummy.restapiexample.com/api/v1/employees every 10 seconds, this rest API with json response, and log this in an index so i can do my thing in splunk with the data. 🙂

Re: Possible to ingest REST API JSON data with splunk initiating poll?

to4kawa — Fri, 24 Apr 2020 01:19:10 GMT

try https://splunkbase.splunk.com/app/2962/

Re: Possible to ingest REST API JSON data with splunk initiating poll?

pir8radio — Fri, 24 Apr 2020 01:21:33 GMT

addon builder? Do you have some setup examples as to how i would make it work with the above REST API link?

Re: Possible to ingest REST API JSON data with splunk initiating poll?

esix_splunk — Fri, 24 Apr 2020 01:47:49 GMT

Check the docs for AddOn builder - Addon Builder Docs @ Splunk

There are examples there how to create inputs, test the data pull, perform and normalize field extractions. All good stuff, and not too difficult to understand.

Re: Possible to ingest REST API JSON data with splunk initiating poll?

wwhite12 — Fri, 24 Apr 2020 02:05:13 GMT

The Splunk REST Modular Input app will give you the REST API option when you go to Settings >> Add Data >> Monitor like this, here you can set the interval, what response type, sourctype, etc. It will require an activation key from the developer, BaboonBones, not sure if that means $$$ or not
https://splunkbase.splunk.com/app/1546/#/overview

Re: Possible to ingest REST API JSON data with splunk initiating poll?

pir8radio — Fri, 24 Apr 2020 14:16:02 GMT

cool, i didnt know that plugin existed, ill see what it costs.. thx.