All Apps and Add-ons

REST API Modular Input: Why does a Splunk restart trigger rest_ta call, regardless of the polling interval setting?

Path Finder

When I restart Splunk, the rest_ta data inputs trigger a call, even though the polling interval is set to 86400.
Any ideas? My data is getting doubled, tripled, etc simply by restarting the Splunk.

Path Finder
./splunk  _internal call /services/apps/local/your_application_name/_reload -auth admin:$ADMINPWD

use above setting and let me know how it goes.

0 Karma

Ultra Champion

There is not persistent state associated with the poller timing across process restarts.
When you restart Splunk you kill the REST TA process.Ergo , upon restart , the poller starts again.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!