All Apps and Add-ons
Highlighted

REST API Modular Input: How do I adjust the frequency the REST API makes HTTP requests?

Explorer

I need that REST API makes HTTP requests only once a minute. How I make this?

This API makes many requests per minute. I don't need this. I can't adjust the frequency of requests.

I change the field "Sequential Stagger Time", but this doesn't do anything.

0 Karma
Highlighted

Re: REST API Modular Input: How do I adjust the frequency the REST API makes HTTP requests?

Ultra Champion

The polling interval parameter controls the frequency of requests.The default is 60 seconds.

As per the description in the UI :

alt text

If you are seeing more requests, then perhaps my guesses are :

1) you have errors , search with "index_internal ExecProcessor error rest.py" to find any
2) you have some other rest.py processes in the background doing things

0 Karma
Highlighted

Re: REST API Modular Input: How do I adjust the frequency the REST API makes HTTP requests?

Explorer

So,

  1. I didn't find any erros. This API executes perfectly;
  2. When I disable, the requests stops immediately.

Below, the content of inputs.conf without some confidentiality attributes

[rest://RequestFresh]
auth_type = basic
http_header_propertys = Content-Type=application/json
http_method = GET
index = freshdesk
index_error_response_codes = 0
response_type = json
sequential_mode = 0
sourcetype = freshdesk
streaming_request = 0
url_args = format=json,page=1
disabled = 1
sequential_stagger_time = 
polling_interval = 600000
0 Karma
Highlighted

Re: REST API Modular Input: How do I adjust the frequency the REST API makes HTTP requests?

Ultra Champion

Are you performing token replacement in the URL ?

Also, just an observation 600000 should be 60 (seconds).

There was a typo in my error search string above , try this in Splunk:

index=_internal ExecProcessor error rest.py
0 Karma
Highlighted

Re: REST API Modular Input: How do I adjust the frequency the REST API makes HTTP requests?

Explorer

Thank you for efforts on helping me, but:

I'm not perfoming token replacement.

I put 600000 for tests and other higher values, but the frequency of requests remains unchanged.

I tried this search query, but it didn't return any results. The app indexes responses perfectly, but tcpdump in Linux confirms the number of requests.

0 Karma