All Apps and Add-ons

REST API Modular - Why are the dynamic tokens used for URL not updating?

New Member

Hi all,

I'm currently using the Modular REST API to pull data from a REST API which allows me to specify the earliest time for events through an argument in the URL.

I'm using the dynamic token functionality to put a unix timestamp into the URL, all works well. My python code in just gets the current linux time and takes 80 seconds from it.

My interval is then set to 60 seconds and in theory I shouldn't lose any data from the API.

However the REST API Add-on seems to always issue the same request to the API. If I restart splunk then it seems to update and the API call uses the correct time, however then it just keeps using the same time, although the Python code should be updating.

Here's the Python code.

def eightySecondsAgo():
unixEpochTimeNow = time.time()
timeEightySecondsAgo = int(unixEpochTimeNow) - 80
return str(timeEightySecondsAgo)

Any my inputs.conf

activation_key = <redacted>
http_header_propertys = authorization=Bearer <redacted>,accept=application/json,content-type=application/json
http_method = GET
auth_type= none
response_type = json

It's like the dynamic token response is being cached or something? Really strange.

Any ideas?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...