Compatible with Splunk 6?

[yuwtennis]

Hi!

I have upgraded the splunk from v 5.0.4 to v 6 but after I upgraded
the "REST" has been deleted from the Data Input view.

I find this app is very useful to communicate with the twitter dev
so I would like to request for the upgrade of this app.

Thanks,
Yu

[jbrodsky_splunk]

It's actually a little more confusing than mentioned above.

The documentation sure has a nice Splunk ">" in it, but when you click on the Documentation tab, under Dependencies, it says "5.0+". Plus what? Plus a minor revision to 5? Or 6? That's in the README too.

Anyway. It gets stranger.

The REST API (and other modular input GUI links, like the SNMP) appear to get clobbered by DB Connect. If I delete DB Connect from my Splunk instance, the REST API and SNMP gui links come back.

Here's a workaround that may work for you, if you have DB Connect and REST inputs installed together.

Go to http://YOURSPLUNKHOST:8000/en-US/manager/search/data/inputs/rest. This brings up the page to configure the REST inputs.

Regardless of any of this - this appears to be a GUI-only thing. If you define your REST API input in an inputs.conf (check the spec in the README directory of the app) then the input(s) that you define WILL work on 6. Or use the workaround above - works for me here.

PS - Same behavior for the SNMP modular input. Input works fine when defined in an inputs.conf, but GUI page not there. Go to http://YOURSPLUNKHOST:8000/en-US/manager/search/data/inputs/snmp.

[jbrodsky_splunk]

Well - as I said, use that direct URL and it should work. Incidentally, this morning I realized it was DB Connect install that was somehow clobbering the GUI links to the REST and SNMP inputs on my system. Check the edit I did above.

[yuwtennis]

Hello jbrodsky_splunk.

I see.

I will manually change the inputs.conf till the GUI is fixed...

Thanks,
Yu

[ChrisG · Accepted solution]

Which app? Is it marked as compatible with version 6 on its page on Splunk Apps?

[yuwtennis]

Hello Chris.

I see.

Thanks!

Yu

[ChrisG]

It is compatible with 5.0, not 6.0. The ">" is not actually a greater-than sign, it just represents Splunk...but I can see why that confused you!

[yuwtennis]

Hello Chris.

Thank you for the reply.

I was mentioning about this app.

REST API Modular Input
http://apps.splunk.com/app/1546/

It seems that its compatible with > 5.0.

Thanks,
Yu