All,
I installed the REST API Modular Input add-on ( app 1546) and configured it to get twitter feeds from http discoveredintelligence . ca / stream-twitter-splunk-10-simple-steps .... sorry I do not have enough points to post links
It was working great with Splunk seeing the fields and stripping them out for the "Interesting Fields" section. We wanted to modify the REST API call and add some more tags to ingest into splunk. The instructions told us that the API Call configuration would be in etc/system/loca/inputs.conf and sure enough it was there. We edit the config and added a few more tags ... restarted Splunk and there the new tags where injested. We noticed that we were just getting tags and not actual tweets from specific users, so I figured we create a new API call for "follows" to ingest tweets on specific people we "follow".
Instead it was suggested to just copy the config in the inputs.conf and modify it. This was done and after restarting Splunk ... splunk stopped stripping out "interesting fields"
I figured doing the copy of the config messed it up, so I decided to clear out the twitter index and delete the REST API app and reinstall it and start fresh.
I did this, but every time I re-install the REST API add-on, twitter data just starts flowing back into the twitter index even before I can enter a new API call. I cleared the config from inputs.conf and deleted the REST API ... where else can there be configurations for the API call that is causing the API to call automatically upon re-installation with out setting up the new API Call ??
Any help would be great !
Thanks
Pete
