All Apps and Add-ons

How to get RSS data into splunk

vrmandadi
Builder

alt textIs there an add-onn or way to get the RSS data for webex into splunk to know its health status? .I used https://splunkbase.splunk.com/app/2646/

Thanks in Advance

0 Karma

asneed_eu
Path Finder

There's an add-on on Splunkbase for ingesting generic RSS feeds.

https://splunkbase.splunk.com/app/2646/

0 Karma

asneed_eu
Path Finder

At first I used 5 minutes for testing.

I would try some other troubleshooting options just in case, like double checking the index (in my test environment it went to index=main), and the connectivity between the Splunk node and the RSS endpoint.

0 Karma

vrmandadi
Builder

Thanks.it went to index=main , I actually created a new index webex , but somehow it is overriding the sourcetype and index .Do you know how to change that

0 Karma

asneed_eu
Path Finder

I deleted my test environment, but if there's no option to set index through the UI for this app, it may have to be set in the inputs.conf file the app creates.

If this is still overwritten, it may need to be set with a transforms.conf index override (see this answer: https://answers.splunk.com/answers/100609/redirection-to-different-index-using-transforms-conf.html).

Hopefully the first option works.

0 Karma

vrmandadi
Builder

I installed the add-on and gave the URL https://status.webex.com/service/status?lang=en_US but I dont see any data.I have attached a screenshot of the input created in the question

0 Karma

asneed_eu
Path Finder

I saw that link in the top-right hand corner of the page you linked to in a previous comment -- It looks like a sort of global status feed for Webex, and it's in an rss format.

There's a black and white RSS icon in the corner.

0 Karma

vrmandadi
Builder

Ya.I see that .I tried using the same one but did not get data into Splunk .Should I create a new input or disable and enable the existing ? .What settings you have made in the input like time interval ,Include only new or changed entries,Convert HTML to Text

0 Karma

asneed_eu
Path Finder

I didn't have do do much configuration at all -- this was my input setup:
alt text

0 Karma

vrmandadi
Builder

I cant see the image you posted

0 Karma

asneed_eu
Path Finder

Try this url:

https://i.ibb.co/PhkCcnd/splunk-answers-ss.png

If it still doesn't work I'd recommend double checking your connectivity from the Splunk server in question to that webex rss url.

0 Karma

vrmandadi
Builder

Still not seeing .What is the interval setup on your input?

0 Karma

asneed_eu
Path Finder

In a test environment I was able to pull in data from this url:

https://status.webex.com/history.rss

Is this the data you're trying to pull in?

0 Karma

vrmandadi
Builder

What is the URL that you have used? .I used this URL https://status.webex.com/service/status?lang=en_US . If you see the URL that I sent ,you can see something like webex meeting , webex and it shows status operational .I am trying to get that data .Is that same as the URL you sent me or is it something different

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!