All Apps and Add-ons

How to accept batch input from JSON REST API modular input?

dhruvgargTA
New Member

I have an endpoint that displays json data and I am looking for the REST polling data source to take native json lists and parse that as batch event input into Splunk.

Any Ideas?

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Use a custom response handler with the REST Modular Input that will can split up the batch json response into individual events .

You declare the name of the response handler in your REST setup screen.

You place the implementation of the response handler in rest_ta/bin/responsehandlers.py

Ships with loads of examples to refer to and copy.

View solution in original post

0 Karma

Damien_Dallimor
Ultra Champion

Use a custom response handler with the REST Modular Input that will can split up the batch json response into individual events .

You declare the name of the response handler in your REST setup screen.

You place the implementation of the response handler in rest_ta/bin/responsehandlers.py

Ships with loads of examples to refer to and copy.

0 Karma

dhruvgargTA
New Member

Hmm, after investigating the response handlers in the file, there's a default JSONArrayHandler that solves my problem perfectly. No custom code necessary.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...