All Apps and Add-ons

How to configure the Splunk Rest Modular Input to get data?

Kendo213
Communicator

I'm attempting to get some data out of an EMC Unity Array. Using the Restlet Chrome Extension, I can get valid data back with this URL:

https://IP/api/types/metricValue/instances?filter=path eq "sp.*.cpu.summary.utilization" &per_page=1

When I configure the REST Modular Input the same way, I get no data basically. Here is what I receive:

<!DOCTYPE html><html><head><meta http-equiv="Cache-Control" content="no-store"; charset=UTF-8 > <script type="text/javascript">function getUrlVars(location) {    var vars = [], hash;     var hashes = location.href.slice(location.href.indexOf('?') + 1).split('&');    for(var i = 0; i < hashes.length; i++){        hash = hashes[i].split('=');        vars[hash[0]] = hash[1];    }    return vars;}var winlocation = window.location;var hrefSplit = winlocation.href.split('#'); var destloc = '/misc/index.jsp' + '?' + 'url=' + encodeURIComponent(hrefSplit[0])+'&'+'hash='+encodeURIComponent(hrefSplit[1]);var casHomeValue=getUrlVars(winlocation)['casHome'];if (casHomeValue) {    destloc += '&' +'casHome'+'='+encodeURIComponent(casHomeValue);}window.location=destloc;</script></head></html>

The documentation is pretty slim, so I'm assuming I'm doing it wrong. Any ideas?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Have you installed this app? If so, then have you configured your endpoint correctly?

https://splunkbase.splunk.com/app/1546/#/details

0 Karma

marianomromano
Engager

I had to do that same thing. You have to point to a specific argument. The question is, were you able to get the sp..storage.lun..currentIOCount? I have been struggling trying to get the correct URL to pull that data.

0 Karma

Kendo213
Communicator

That's the app I'm using, and that is returning the data I provided in the original post. I'm using the GUI to input the parameters for the REST API of the EMC Unity array.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You should try something simple to test it out. You can grab a test API string from Google and verify its working as expected. Next, you should try doing a simple CURL with your api string to verify its working as expected

0 Karma

Kendo213
Communicator

I could only get this working by putting the URL to the metric I'm wanting to track in the Endpoint URL field. If I put the base IP in the URL, and then added URL arguments, it wouldn't work.

I'm not sure why this is the case 😕

0 Karma

Kendo213
Communicator

It works when I test it via a little Chrome extension. So I know the permissions are correct, and the URL parameters are correct. So, I'm assuming I'm just not putting it in correctly in the app 😕 However, there is no indication in splunkd.log of a mis-configuration, so I'm not sure.

If I login to the EMC console in Chrome, and then bring up Restlet, and perform a GET against https://ip/api/types/metricValue/instances?filter=path eq "sp.*.cpu.summary.utilization" &per_page=1 I receive the json format return I'm expecting.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...