All Apps and Add-ons

REST API Modular Input (break singe JSON array event in to multiple events)

splunk_m_valdes
Loves-to-Learn Lots

Hi everyone,


Im using Splunk APP https://splunkbase.splunk.com/app/1546/
I want to split a single JSON array event to multiple events by the word"addrRef".
if you see my JSON array example and at the end I wrote Response handler which is not working
but is not sending any error either when I look at my "_internal" logs.

If anyone could tell me why my reponse handler is not working or what Im doing wrong?

Best regards

 

Json Array

{ [-]
result: { [-]
ipamRecords: [ [-]
{ [-]
addrRef: IPAMRecords/248211
address: 10.1.1.20
claimed: false
customProperties: { [+]
}
device:
dhcpLeases: [ [+]
]
dhcpReservations: [ [+]
]
discoveryType: ARP
dnsHosts: [ [+]
]
extraneousPTR: false
interface:
lastDiscoveryDate: Feb 3, 2022 08:11:04
lastKnownClientIdentifier: AB:BA:CA:FF:EA:66
lastSeenDate: Feb 3, 2022 07:55:17
ptrStatus: OK
state: Assigned
usage: 25140
}
{ [-]
addrRef: IPAMRecords/357310
address: 10.2.2.21
claimed: false
customProperties: { [+]
}
device:
dhcpLeases: [ [+]
]
dhcpReservations: [ [+]
]
discoveryType: Ping
dnsHosts: [ [+]
]
extraneousPTR: false
interface:
lastDiscoveryDate: Feb 2, 2022 13:40:17
lastKnownClientIdentifier: BA:BB:AA:B5:28:AC
lastSeenDate: Nov 3, 2017 17:07:34
ptrStatus: OK
state: Assigned
usage: 24596
}
{ [+]
}
{ [+]
}
{ [+]
}
{ [+]
}
{ [+]
}
]
totalResults: 7
}
}


MY RESPONSE HANDLER NOT WORKING, BUT NOT GIVING ANY ERROR ON  "index=_interna host=Myhost":

vi /opt/splun/etc/apps/rest_ta/bin/responsehandlers.py

class MenAndMiceHandler:

def __init__(self,**args):
pass

def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
if response_type == "json":

output = json.loads(raw_response_output)

for addrRef in output:
print_xml_stream(json.dumps(addrRef))
else:
print_xml_stream(raw_response_output)

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...