Hi all,
I'm currently using the Modular REST API to pull data from a REST API which allows me to specify the earliest time for events through an argument in the URL.
I'm using the dynamic token functionality to put a unix timestamp into the URL, all works well. My python code in tokens.py just gets the current linux time and takes 80 seconds from it.
My interval is then set to 60 seconds and in theory I shouldn't lose any data from the API.
However the REST API Add-on seems to always issue the same request to the API. If I restart splunk then it seems to update and the API call uses the correct time, however then it just keeps using the same time, although the Python code should be updating.
Here's the Python code.
def eightySecondsAgo():
unixEpochTimeNow = time.time()
timeEightySecondsAgo = int(unixEpochTimeNow) - 80
return str(timeEightySecondsAgo)
Any my inputs.conf
[rest://Intercom_admin_events]
activation_key = <redacted>
endpoint=https://api.intercom.io/admins/activity_logs?created_at_after=$eightySecondsAgo$
http_header_propertys = authorization=Bearer <redacted>,accept=application/json,content-type=application/json
http_method = GET
auth_type= none
response_type = json
streaming_request=0
verify=0
sourcetype=intercom.admin.events
polling_interval=60
It's like the dynamic token response is being cached or something? Really strange.
Any ideas?
