REST API Modular Input : Polling interval is not consistant

[Lucas_K]

I checked an issue with a rest api data input and found that the scheduling of the poll is inconsistent.

With the polling interval set to 300 there is a 5 second difference each and every time the job is run.

This causes an issue for calls that utilize point in time updates or require more accurate polling. 

I can mitigate this issue for the most part by looking at the internal logs for the time the inputs are trigger and offset the schedule by that time it is still out by around 1 second however so we still miss events.

[yoho]

This has no relationship with the REST API Modular Input, it's due to the Splunk scheduler. Indeed, it's not meant to be precise but reliable.

If you need precision, it's up to the server to implement a way for you to ask the status at a specific time. Otherwise, you will always be subject to traffic congestion, server or client resource exchaustion, downtimes, etc... Another way around is by using HEC: it's up to your server to push data to splunk.