topic Re: How to get RSS data into splunk in All Apps and Add-ons

How to get RSS data into splunk

vrmandadi — Thu, 26 Mar 2020 15:42:23 GMT

Is there an add-onn or way to get the RSS data for webex into splunk to know its health status? .I used https://splunkbase.splunk.com/app/2646/

Thanks in Advance

Re: How to get RSS data into splunk

asneed_eu — Thu, 26 Mar 2020 15:59:29 GMT

There's an add-on on Splunkbase for ingesting generic RSS feeds.

https://splunkbase.splunk.com/app/2646/

Re: How to get RSS data into splunk

vrmandadi — Thu, 26 Mar 2020 16:14:12 GMT

I installed the add-on and gave the URL https://status.webex.com/service/status?lang=en_US but I dont see any data.I have attached a screenshot of the input created in the question

Re: How to get RSS data into splunk

asneed_eu — Thu, 26 Mar 2020 16:31:57 GMT

In a test environment I was able to pull in data from this url:

https://status.webex.com/history.rss

Is this the data you're trying to pull in?

Re: How to get RSS data into splunk

vrmandadi — Thu, 26 Mar 2020 16:50:09 GMT

What is the URL that you have used? .I used this URL https://status.webex.com/service/status?lang=en_US . If you see the URL that I sent ,you can see something like webex meeting , webex and it shows status operational .I am trying to get that data .Is that same as the URL you sent me or is it something different

Re: How to get RSS data into splunk

asneed_eu — Thu, 26 Mar 2020 16:53:46 GMT

I saw that link in the top-right hand corner of the page you linked to in a previous comment -- It looks like a sort of global status feed for Webex, and it's in an rss format.

There's a black and white RSS icon in the corner.

Re: How to get RSS data into splunk

vrmandadi — Thu, 26 Mar 2020 17:01:14 GMT

Ya.I see that .I tried using the same one but did not get data into Splunk .Should I create a new input or disable and enable the existing ? .What settings you have made in the input like time interval ,Include only new or changed entries,Convert HTML to Text

Re: How to get RSS data into splunk

asneed_eu — Thu, 26 Mar 2020 17:07:31 GMT

I didn't have do do much configuration at all -- this was my input setup:

Re: How to get RSS data into splunk

vrmandadi — Thu, 26 Mar 2020 17:13:31 GMT

I cant see the image you posted

Re: How to get RSS data into splunk

asneed_eu — Thu, 26 Mar 2020 17:17:41 GMT

Try this url:

https://i.ibb.co/PhkCcnd/splunk-answers-ss.png

If it still doesn't work I'd recommend double checking your connectivity from the Splunk server in question to that webex rss url.

Re: How to get RSS data into splunk

vrmandadi — Thu, 26 Mar 2020 19:03:36 GMT

Still not seeing .What is the interval setup on your input?

Re: How to get RSS data into splunk

asneed_eu — Thu, 26 Mar 2020 19:07:09 GMT

At first I used 5 minutes for testing.

I would try some other troubleshooting options just in case, like double checking the index (in my test environment it went to index=main), and the connectivity between the Splunk node and the RSS endpoint.

Re: How to get RSS data into splunk

vrmandadi — Thu, 26 Mar 2020 20:43:19 GMT

Thanks.it went to index=main , I actually created a new index webex , but somehow it is overriding the sourcetype and index .Do you know how to change that

Re: How to get RSS data into splunk

asneed_eu — Thu, 26 Mar 2020 23:38:35 GMT

I deleted my test environment, but if there's no option to set index through the UI for this app, it may have to be set in the inputs.conf file the app creates.

If this is still overwritten, it may need to be set with a transforms.conf index override (see this answer: https://answers.splunk.com/answers/100609/redirection-to-different-index-using-transforms-conf.html).

Hopefully the first option works.

Re: How to get RSS data into splunk

567353544546456 — Thu, 21 Apr 2022 20:50:26 GMT

How do I get to that menu?