All Apps and Add-ons

How to configure request payload in a POST HTTP Method with REST API Modular Input?

erwan_raulet
Explorer

I want to use REST API Modular Input to count alarms from my Spectrum monitoring tool.
Here's the query I'm using with Postman to query my Spectrum server:

POST /spectrum/restful/alarms/count HTTP/1.1 
Host: MyServer:8080
Content-Type: application/xml,application/json
Authorization: Basic YmNpdC1waWwdcnBpbG90ZTE=
cache-control: no-cache 
<?xml version="1.0" encoding="UTF-8"?>
<rs:alarms-count-request xmlns:rs="http://www.ca.com/spectrum/restful/schema/request"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.ca.com/spectrum/restful/schema/request
../../../xsd/Request.xsd ">
<rs:alarm-filter name="def"/> 
</rs:alarms-count-request>

And the response:

<?xml version="1.0" encoding="UTF-8"
standalone="yes"?>
<alarmcount-response
xmlns="http://www.ca.com/spectrum/restful/schema/response">
    <critical>3</critical>
    <major>2</major>
    <minor>4</minor> </alarmcount-response>

Now its configuration in the module REST_ta of Splunk.

alt text

I get an HTTP 500 error in splunkd.log
I think this comes from the Request Payload field but I do not see my error. Can someone help me?

0 Karma

AKG1_old1
Builder

@erwan_raulet : Did you able to solve it  ? I have the same requirements. Not sure what format required in payload 

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...