All Apps and Add-ons

Meraki Dashboard API works fine with Insomnia Rest Client but does not work with REST API Modular input

raynold_peterso
Path Finder

I am working on pulling the status and such of our Meraki AP's with the REST API Modular Input App for Splunk. Before I started configuring Splunk, I configured my Insomnia REST Client to pull,GET ,the data that I expect Splunk to pull. The Insomnia Client works just find with the following curl config:

curl --request GET \
--url https://api.meraki.com/api/v0/organizations/341515/deviceStatuses \
--header 'content-type: application/json' \
--header 'x-cisco-meraki-api-key: abcxyz......' \
--cookie BCSI-CS-cd9b29b41b5a35a5=2

output:

[
    {
        "name": "TXDADG-AP1",
        "serial": "Q2GD-C8Q2-XK4Y",
        "mac": "00:18:0a:ea:86:10",
        "publicIp": "192.251.189.86",
        "networkId": "L_568579452955526404",
        "status": "offline",
        "lanIp": "10.162.178.11"
    },
    {
        "name": "Brock-MX600",
        "serial": "Q2GN-2MQU-N2T8",
        "mac": "00:18:0a:02:c3:f0",
        "publicIp": "192.251.189.111",
        "networkId": "L_568579452955526404",
        "status": "online",
        "usingCellularFailover": false,
        "wan1Ip": "192.168.224.7",
        "wan2Ip": null
    }
]

All as expected. I think I am golden, but no.....It's not so....

I move to Splunk to configure the REST API Modular Input, which I have working for other inputs. Where is the non-working config:

[rest://Meraki Network Device Status]
activation_key = 3C3FA5F032624FA3CAD44F2D37F87A8B
auth_type = none
endpoint = http://dashboard.meraki.com/api/v0/organizations/341515/deviceStatuses
http_header_propertys = x-cisco-meraki-api-key="abcxyz......",content-type="application/json"
http_method = GET
http_proxy = UserId:Passwd@10.10.999.999:8080
https_proxy = UserId:Passwd@10.10.999.999:8080
index = meraki
index_error_response_codes = 1
polling_interval = */1 * * * *
response_type = json
sequential_mode = 0
sourcetype = meraki_status
streaming_request = 0
disabled = 0

I am getting in the splunkd log the following message:

http_error_code = 404 error_message =  

It appears that I am getting to the site but the requested page is not found.

Hmmmm, Its the same url request with the Insomnia Client as in the SMARTS Config.

What could be my stumbling block? Did I fat finger something?

Any help at this point would be very helpful.

Thanks in advance,
Rcp

Tags (1)
0 Karma

raynold_peterso
Path Finder

I tested it both ways with the same results. I get a 404 error with http or https.

Rcp

0 Karma

Damien_Dallimor
Ultra Champion

Your curl example is https , and in your Splunk REST config you are using http and a different URI. Possibe error ?

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...