Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- How to configure the Splunk Rest Modular Input to ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to configure the Splunk Rest Modular Input to get data?
I'm attempting to get some data out of an EMC Unity Array. Using the Restlet Chrome Extension, I can get valid data back with this URL:
https://IP/api/types/metricValue/instances?filter=path eq "sp.*.cpu.summary.utilization" &per_page=1
When I configure the REST Modular Input the same way, I get no data basically. Here is what I receive:
<!DOCTYPE html><html><head><meta http-equiv="Cache-Control" content="no-store"; charset=UTF-8 > <script type="text/javascript">function getUrlVars(location) { var vars = [], hash; var hashes = location.href.slice(location.href.indexOf('?') + 1).split('&'); for(var i = 0; i < hashes.length; i++){ hash = hashes[i].split('='); vars[hash[0]] = hash[1]; } return vars;}var winlocation = window.location;var hrefSplit = winlocation.href.split('#'); var destloc = '/misc/index.jsp' + '?' + 'url=' + encodeURIComponent(hrefSplit[0])+'&'+'hash='+encodeURIComponent(hrefSplit[1]);var casHomeValue=getUrlVars(winlocation)['casHome'];if (casHomeValue) { destloc += '&' +'casHome'+'='+encodeURIComponent(casHomeValue);}window.location=destloc;</script></head></html>
The documentation is pretty slim, so I'm assuming I'm doing it wrong. Any ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you installed this app? If so, then have you configured your endpoint correctly?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had to do that same thing. You have to point to a specific argument. The question is, were you able to get the sp..storage.lun..currentIOCount? I have been struggling trying to get the correct URL to pull that data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's the app I'm using, and that is returning the data I provided in the original post. I'm using the GUI to input the parameters for the REST API of the EMC Unity array.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should try something simple to test it out. You can grab a test API string from Google and verify its working as expected. Next, you should try doing a simple CURL with your api string to verify its working as expected
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I could only get this working by putting the URL to the metric I'm wanting to track in the Endpoint URL field. If I put the base IP in the URL, and then added URL arguments, it wouldn't work.
I'm not sure why this is the case 😕
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It works when I test it via a little Chrome extension. So I know the permissions are correct, and the URL parameters are correct. So, I'm assuming I'm just not putting it in correctly in the app 😕 However, there is no indication in splunkd.log of a mis-configuration, so I'm not sure.
If I login to the EMC console in Chrome, and then bring up Restlet, and perform a GET against https://ip/api/types/metricValue/instances?filter=path eq "sp.*.cpu.summary.utilization" &per_page=1 I receive the json format return I'm expecting.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
