All Apps and Add-ons

REST API Modular - Why are the dynamic tokens used for URL not updating?

Stu-eonnext
New Member

Hi all,

I'm currently using the Modular REST API to pull data from a REST API which allows me to specify the earliest time for events through an argument in the URL.

I'm using the dynamic token functionality to put a unix timestamp into the URL, all works well. My python code in tokens.py just gets the current linux time and takes 80 seconds from it.

My interval is then set to 60 seconds and in theory I shouldn't lose any data from the API.

However the REST API Add-on seems to always issue the same request to the API. If I restart splunk then it seems to update and the API call uses the correct time, however then it just keeps using the same time, although the Python code should be updating.

Here's the Python code.

def eightySecondsAgo():
unixEpochTimeNow = time.time()
timeEightySecondsAgo = int(unixEpochTimeNow) - 80
return str(timeEightySecondsAgo)

Any my inputs.conf

[rest://Intercom_admin_events]
activation_key = <redacted>
endpoint=https://api.intercom.io/admins/activity_logs?created_at_after=$eightySecondsAgo$
http_header_propertys = authorization=Bearer <redacted>,accept=application/json,content-type=application/json
http_method = GET
auth_type= none
response_type = json
streaming_request=0
verify=0
sourcetype=intercom.admin.events
polling_interval=60

It's like the dynamic token response is being cached or something? Really strange.

Any ideas?

Labels (1)
Tags (1)
0 Karma

loggar
Explorer

The problem is that the endpoint_list variable is set the first time the script runs, but is never updated after that.

I just edited rest_ta/bin/rest.py, before the " for endpoint in endpoint_list " loop as below :

(begins at line 465 in version 1.4 of the REST Modular Input App)

loggar_0-1700487539055.png

After that, tokens are always updated with tokens.py file before the REST API is polled.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...