All Apps and Add-ons

REST API Modular - Why are the dynamic tokens used for URL not updating?

Stu-eonnext
New Member

Hi all,

I'm currently using the Modular REST API to pull data from a REST API which allows me to specify the earliest time for events through an argument in the URL.

I'm using the dynamic token functionality to put a unix timestamp into the URL, all works well. My python code in tokens.py just gets the current linux time and takes 80 seconds from it.

My interval is then set to 60 seconds and in theory I shouldn't lose any data from the API.

However the REST API Add-on seems to always issue the same request to the API. If I restart splunk then it seems to update and the API call uses the correct time, however then it just keeps using the same time, although the Python code should be updating.

Here's the Python code.

def eightySecondsAgo():
unixEpochTimeNow = time.time()
timeEightySecondsAgo = int(unixEpochTimeNow) - 80
return str(timeEightySecondsAgo)

Any my inputs.conf

[rest://Intercom_admin_events]
activation_key = <redacted>
endpoint=https://api.intercom.io/admins/activity_logs?created_at_after=$eightySecondsAgo$
http_header_propertys = authorization=Bearer <redacted>,accept=application/json,content-type=application/json
http_method = GET
auth_type= none
response_type = json
streaming_request=0
verify=0
sourcetype=intercom.admin.events
polling_interval=60

It's like the dynamic token response is being cached or something? Really strange.

Any ideas?

Labels (1)
Tags (1)
0 Karma

loggar
Explorer

The problem is that the endpoint_list variable is set the first time the script runs, but is never updated after that.

I just edited rest_ta/bin/rest.py, before the " for endpoint in endpoint_list " loop as below :

(begins at line 465 in version 1.4 of the REST Modular Input App)

loggar_0-1700487539055.png

After that, tokens are always updated with tokens.py file before the REST API is polled.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...