All Apps and Add-ons

Meraki Dashboard API works fine with Insomnia Rest Client but does not work with REST API Modular input

raynold_peterso
Path Finder

I am working on pulling the status and such of our Meraki AP's with the REST API Modular Input App for Splunk. Before I started configuring Splunk, I configured my Insomnia REST Client to pull,GET ,the data that I expect Splunk to pull. The Insomnia Client works just find with the following curl config:

curl --request GET \
--url https://api.meraki.com/api/v0/organizations/341515/deviceStatuses \
--header 'content-type: application/json' \
--header 'x-cisco-meraki-api-key: abcxyz......' \
--cookie BCSI-CS-cd9b29b41b5a35a5=2

output:

[
    {
        "name": "TXDADG-AP1",
        "serial": "Q2GD-C8Q2-XK4Y",
        "mac": "00:18:0a:ea:86:10",
        "publicIp": "192.251.189.86",
        "networkId": "L_568579452955526404",
        "status": "offline",
        "lanIp": "10.162.178.11"
    },
    {
        "name": "Brock-MX600",
        "serial": "Q2GN-2MQU-N2T8",
        "mac": "00:18:0a:02:c3:f0",
        "publicIp": "192.251.189.111",
        "networkId": "L_568579452955526404",
        "status": "online",
        "usingCellularFailover": false,
        "wan1Ip": "192.168.224.7",
        "wan2Ip": null
    }
]

All as expected. I think I am golden, but no.....It's not so....

I move to Splunk to configure the REST API Modular Input, which I have working for other inputs. Where is the non-working config:

[rest://Meraki Network Device Status]
activation_key = 3C3FA5F032624FA3CAD44F2D37F87A8B
auth_type = none
endpoint = http://dashboard.meraki.com/api/v0/organizations/341515/deviceStatuses
http_header_propertys = x-cisco-meraki-api-key="abcxyz......",content-type="application/json"
http_method = GET
http_proxy = UserId:Passwd@10.10.999.999:8080
https_proxy = UserId:Passwd@10.10.999.999:8080
index = meraki
index_error_response_codes = 1
polling_interval = */1 * * * *
response_type = json
sequential_mode = 0
sourcetype = meraki_status
streaming_request = 0
disabled = 0

I am getting in the splunkd log the following message:

http_error_code = 404 error_message =  

It appears that I am getting to the site but the requested page is not found.

Hmmmm, Its the same url request with the Insomnia Client as in the SMARTS Config.

What could be my stumbling block? Did I fat finger something?

Any help at this point would be very helpful.

Thanks in advance,
Rcp

Tags (1)
0 Karma

raynold_peterso
Path Finder

I tested it both ways with the same results. I get a 404 error with http or https.

Rcp

0 Karma

Damien_Dallimor
Ultra Champion

Your curl example is https , and in your Splunk REST config you are using http and a different URI. Possibe error ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...