All Apps and Add-ons

REST API Modular Input: Why does no data arrive in the index?

bvivi57
Observer

Hi,
I am trying to query a Rest API from within the application.
The query seems to work and be executed but no data is indexed.
If I test a simple curl from the Splunk server, I have a return.
alt text

If I listen to the exchanges between the Splunk server and the url, there is a return.
alt text
Here is my setup
alt text
alt text

I do not see any error in log splunkd.log

I do not know what to look at. Can you help me understand why no data arrives in the index?

0 Karma

nicolasjeanselm
Explorer

Hello,

Search this: index="_internal" REST_ta

alt text

0 Karma

natalienguyen
Explorer

Hi,

I'm having this issue as well. Did you ever figure out a solution?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...