All Apps and Add-ons

New user & REST API

TravisT
Engager

I'm a new Splunk user and I'm trying to get a simplistic working data feed that I can build off of.  I tend to learn better that way.

I'm trying to use the Ecobee API to poll my smart thermostat for data to import and index in Splunk.  I've searched and found the Add-On Builder for Splunk which seems fitting for the job.  I'm having trouble successfully configuring the app.

I can successfully run the following command from the Splunk server CLI:

 

curl -s -H 'Content-Type: text/json' -H 'Authorization: Bearer MY_ACCESS_TOKEN' 'https://api.ecobee.com/1/thermostat?format=json&body=\{"selection":\{"selectionType":"registered","selectionMatch":"","includeRuntime":true\}\}'

 

I'm having trouble running a successful test with what I believe are the same settings in the Add-On Builder data import wizard.  Below are the settings I'm using in attempt to mirror the command above:

 

REST URL:
https://api.ecobee.com/1/thermostat?format=json&body=\{"selection":\{"selectionType":"registered","selectionMatch":"","includeRuntime":true\}\}

REST method:
GET

REST request headers:
Content-Type           json
Authorization          Bearer MY_ACCESS_TOKEN

 

The output given is:

The response status=403

I feel if I can get a basic query working, that I can step it out from there, but I can't figure out what I'm doing wrong.  Any suggestions?

Labels (1)

vikramyadav
Contributor

Hi @TravisT 


If you want to pull data from API you can create modular input by using Splunk Add-on Builder.
OR you can use Rest Api Add-on to pull data from API.
https://splunkbase.splunk.com/app/1546/

------------------------------------------------------

If this help your like will be appreciated 😀

rnowitzki
Builder

Hi @TravisT ,

Can't help you with the Addon Builder, but 2 other options:

1. Use this App from Splunkbase. Should be ready-to-go.
https://splunkbase.splunk.com/app/1546

2. Put your Curl command in a .sh script, or create a Python that does the same and use a Scripted input. The stdout of the script will be your indexed events in Splunk.

BR
Ralph


--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...