All Apps and Add-ons

REST API Modular Input: How to poll a REST API at a specific time, every day?

Path Finder

I want to poll my REST endpoint at a specific time in the day, every day, at 3:00 AM to be precise.

I remember reading somewhere that the "Polling Interval" in Splunk for setting up REST endpoints can also take a time format, however I can't find the question or document which I originally read this in.

Currently we've got it set to poll daily (86400 seconds or something), however I am assuming this timer starts from the time the service is enabled. So if my assumption is true, it means I have to start every service at 3 in the morning, and disabling it and re-enabling it would completely ruin the timing.

Is there a way to specify a specific time to poll the service, not a simple polling interval.

Note: we do have settings on the REST end that can prevent requests outside of a specified time period from even going through, so technically I could leave it polling every 10 minutes and it wouldn't work outside of the allowed hours, but that would mean a lot of wasted requests during every other 10 minute period of the day.

1 Solution

Path Finder

Nevermind, I just found the answer.. Didn't look hard enough!

The format is "CRON format", funnily enough the other question wanted it at the exact same time period as me, the time for 3AM daily, is:

0 3 * * *

https://answers.splunk.com/answers/268306/rest-api-modular-input-v137-enhancements.html?sort=oldest

View solution in original post

Path Finder

My cron doesn't run for rest_ta polling, nor does time. Is anyone facing the same issue? I have dbconnect on the same host, and doesn't have any issues for its cron or time polling?

Path Finder

Nevermind, I just found the answer.. Didn't look hard enough!

The format is "CRON format", funnily enough the other question wanted it at the exact same time period as me, the time for 3AM daily, is:

0 3 * * *

https://answers.splunk.com/answers/268306/rest-api-modular-input-v137-enhancements.html?sort=oldest

View solution in original post

Path Finder

That's 0 3 (asterisk) (asterisk) (asterisk)

The bold formatting code hidden by asterisks, and I can't edit my answer as I'm too low a rank!

0 Karma

Community Manager
Community Manager

Glad you found your own answer 🙂 and no worries, it looks like Damien (the developer of the add-on) edited your answer for you appropriately 🙂 cheers.

Patrick

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!