REST API Modular Input: How to poll a REST API at a specific time, every day?

[jpanderson]

I want to poll my REST endpoint at a specific time in the day, every day, at 3:00 AM to be precise.

I remember reading somewhere that the "Polling Interval" in Splunk for setting up REST endpoints can also take a time format, however I can't find the question or document which I originally read this in.

Currently we've got it set to poll daily (86400 seconds or something), however I am assuming this timer starts from the time the service is enabled. So if my assumption is true, it means I have to start every service at 3 in the morning, and disabling it and re-enabling it would completely ruin the timing.

Is there a way to specify a specific time to poll the service, not a simple polling interval.

Note: we do have settings on the REST end that can prevent requests outside of a specified time period from even going through, so technically I could leave it polling every 10 minutes and it wouldn't work outside of the allowed hours, but that would mean a lot of wasted requests during every other 10 minute period of the day.

[sshres5]

My cron doesn't run for rest_ta polling, nor does time. Is anyone facing the same issue? I have dbconnect on the same host, and doesn't have any issues for its cron or time polling?

[jpanderson · Accepted solution]

Nevermind, I just found the answer.. Didn't look hard enough!

The format is "CRON format", funnily enough the other question wanted it at the exact same time period as me, the time for 3AM daily, is:

0 3 * * *

https://answers.splunk.com/answers/268306/rest-api-modular-input-v137-enhancements.html?sort=oldest

[jpanderson]

That's 0 3 (asterisk) (asterisk) (asterisk)

The bold formatting code hidden by asterisks, and I can't edit my answer as I'm too low a rank!

[ppablo]

Glad you found your own answer 🙂 and no worries, it looks like Damien (the developer of the add-on) edited your answer for you appropriately 🙂 cheers.

Patrick