Possible to ingest REST API JSON data with splunk initiating poll?

[pir8radio]

I want splunk to reach out to a few goofy devices on my network and grab JSON responses. Is this possible? can I get a few examples?

So to be clear i would like splunk to poll (reach out) say http://dummy.restapiexample.com/api/v1/employees every 10 seconds, this rest API with json response, and log this in an index so i can do my thing in splunk with the data. 🙂

[wwhite12 · Accepted solution]

The Splunk REST Modular Input app will give you the REST API option when you go to Settings >> Add Data >> Monitor like this, here you can set the interval, what response type, sourctype, etc. It will require an activation key from the developer, BaboonBones, not sure if that means $$$ or not
https://splunkbase.splunk.com/app/1546/#/overview

[pir8radio]

cool, i didnt know that plugin existed, ill see what it costs.. thx.

[to4kawa]

try https://splunkbase.splunk.com/app/2962/

[pir8radio]

addon builder? Do you have some setup examples as to how i would make it work with the above REST API link?

[esix_splunk]

Check the docs for AddOn builder - Addon Builder Docs @ Splunk

There are examples there how to create inputs, test the data pull, perform and normalize field extractions. All good stuff, and not too difficult to understand.