Getting response from REST API URL but Splunk log says "503 error"

[FIS1]

Hi,

I installed the REST API Modular Input app and when hitting a URL it returns this output "{"status":"DOWN"}". I would expect to see this in Splunk so I can create a dashboard, but its not in there. Looking at the logs it says the below.

08-29-2017 12:12:02.948 -0500 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\rest_ta\bin\rest.py"" HTTP Request error: 503 Server Error: Service Unavailable

Why can I pull the URL up in the browser and it shows that status down but the log says it received a server error? This is a local install of Splunk on my computer.

[Damien_Dallimor · Accepted solution]

You received a 503 error response from the server and the error message is a JSON payload.

Only non error responses (ie: 200) get indexed.

By default , the REST Mod Input will only log error messages , not index any response data associated with them.

You would have to enable indexing of error responses in your config.

[khnkhurshid]

Damien Dallimore,

could you please elaborate where to configure this,Itried thi but getting Unexpected character while looking for value: 'h' -