REST API dynamic url arguments

[tamduong16]

I have a restful api endpoint that I can make a http get to but it requires that I have to add the from-date and to-date as arguments. They have to be in this format: from-date=2017-10-27T00:00:00&to-date=2017-10-27T23:59:59.

I want to make "from-date" to be the current time minus 15 min and the "to-date" to be in the above format for current time. I did some research and find that I could write a handler to do this. But I still don't understand it. Before I wrote a custom handler class in responsehandler.py to handle the response object after the url get call. But since these arguments have to be added to the url for the http get to work. I still don't know how this will work. Could anyone help me with this please? Thanks

[Damien_Dallimor · Accepted solution]

You would not do this in a custom response handler.

You would do this with a dynamic token in the URL.

Read the section "Token substitution in Endpoint URL" from the docs : https://splunkbase.splunk.com/app/1546/#/details

So you might define your URL like :

And then add functions in rest_ta/bin/tokens.py named myfromdate and mytodate to return the dynamic date values formatted as you wish.

[tamduong16]

Work like a champ! thanks

[Genti]

You can create these arguments like so in spl:

| eval toDate = now(), fromDate=now()-15*60

if you really need to format them, rather than pass them as epoch, then use strftime

| fieldformat toDate=strftime(toDate,"%Y-%m-%dT%H:%M:%S")
| fieldformat fromDate=strftime(fromDate,"%Y-%m-%dT%H:%M:%S")

than pass the toDate and fromDate to your script/url via a token or however you are doing it.

[Genti]

if fieldformat doesn't change the actual value, but just what it looks like in the Splunk ui, then use | eval instead of fieldformat