topic How to combine multiple data input into one with different polling interval in Getting Data In

How to combine multiple data input into one with different polling interval

KJ10 — Thu, 27 Mar 2025 14:45:51 GMT

Hi Team,
How to combine multiple data input into one, basically I am having 5 different data inputs where I am taking same data from User. How to combine all data input into one data input.
I want One data input where I will internally run 2 different data type with different polling interval.
Is this possible with python SDK and How?

Different polling intervals for “performance” and “inventory” data

Re: How to combine multiple data input into one with different polling interval

livehybrid — Thu, 27 Mar 2025 14:50:52 GMT

Hi @KJ10

Can I ask, why are you looking to consolidate the inputs?

I presume the existing 5 inputs are Python based modinputs? Is this in a custom app or something from Splunkbase?

Let me know and I will see if I can work out how best to help.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: How to combine multiple data input into one with different polling interval

KJ10 — Thu, 27 Mar 2025 15:23:01 GMT

Basically we are taking same cred in all 5 data input. So I want to combine them and segregate using performance and inventory data using 2 different time intervals.

Yes existing 5 inputs are Python based modinputs. This in our custom app.

Re: How to combine multiple data input into one with different polling interval

livehybrid — Thu, 27 Mar 2025 16:15:56 GMT

Hi @KJ10

Thanks for your response, ultimately its going to be hard to identify the best approach to this without having the code, but I would suggest determining how its currently written and then checking out the best-practices for the approach taken.

Typically there are 3 ways to create a Splunk app:

Splunk Add-on builder
UCC Framework (my preference)
Custom Python

I'd start by looking at the common code between the 5 existing modules and find where you can put a loop to loop over the the different endpoint (presumably?) that you need to query so that you combine the inputs. Be sure to update the source/sourcetype accordingly for each of the iterations so that your data doesnt end up in one big source/sourcetype and hard to separate between the 5 types.

If you're able to share the code on here (anonymised if required) then I might be able to tailor the help but please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will