All Apps and Add-ons

REST API dynamic url arguments

tamduong16
Contributor

I have a restful api endpoint that I can make a http get to but it requires that I have to add the from-date and to-date as arguments. They have to be in this format: from-date=2017-10-27T00:00:00&to-date=2017-10-27T23:59:59.

I want to make "from-date" to be the current time minus 15 min and the "to-date" to be in the above format for current time. I did some research and find that I could write a handler to do this. But I still don't understand it. Before I wrote a custom handler class in responsehandler.py to handle the response object after the url get call. But since these arguments have to be added to the url for the http get to work. I still don't know how this will work. Could anyone help me with this please? Thanks

1 Solution

Damien_Dallimor
Ultra Champion

You would not do this in a custom response handler.

You would do this with a dynamic token in the URL.

Read the section "Token substitution in Endpoint URL" from the docs : https://splunkbase.splunk.com/app/1546/#/details

So you might define your URL like :

alt text

And then add functions in rest_ta/bin/tokens.py named myfromdate and mytodate to return the dynamic date values formatted as you wish.

View solution in original post

Damien_Dallimor
Ultra Champion

You would not do this in a custom response handler.

You would do this with a dynamic token in the URL.

Read the section "Token substitution in Endpoint URL" from the docs : https://splunkbase.splunk.com/app/1546/#/details

So you might define your URL like :

alt text

And then add functions in rest_ta/bin/tokens.py named myfromdate and mytodate to return the dynamic date values formatted as you wish.

tamduong16
Contributor

Work like a champ! thanks

0 Karma

Genti
Splunk Employee
Splunk Employee

You can create these arguments like so in spl:

| eval toDate = now(), fromDate=now()-15*60

if you really need to format them, rather than pass them as epoch, then use strftime

| fieldformat toDate=strftime(toDate,"%Y-%m-%dT%H:%M:%S")
| fieldformat fromDate=strftime(fromDate,"%Y-%m-%dT%H:%M:%S")

than pass the toDate and fromDate to your script/url via a token or however you are doing it.

0 Karma

Genti
Splunk Employee
Splunk Employee

if fieldformat doesn't change the actual value, but just what it looks like in the Splunk ui, then use | eval instead of fieldformat

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...