All Apps and Add-ons

REST API URL last 5 mins

ansif
Motivator

How to create a splunk addon for REST API data input which calls REST API with a time attribute in the url which should be current time - 5 minutes every calls?

For example:

Current REST API calling time is :2019-11-20T13:05:00

Then rest API url should be

/webacs/api/v4/data/Alarms?alarmFoundAt=gt("2019-11-20T*13:00:00*")

to get alarms past 5 mins.

0 Karma

chli_splunk
Splunk Employee
Splunk Employee

From image https://docs.splunk.com/File:AddonBuilder2.1_REST1.png, there is a parameter begin_date which is similar to your request.
However, there is no functions such as get_current_date in REST based modular input. We need to create a Python input with some Python functions to do that.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...