All Apps and Add-ons

Search and identify connectivity errors in REST Modular Input

rjlohan
Explorer

Hi,

I am using the REST API Modular Input app to query a RabbitMQ management API. If the service goes down, I get connectivity errors (as expected). But I can't see how to report back these errors to the Splunk index from the REST App. I can see errors in the splunkd.log stating;

05-13-2015 11:57:04.305 +1000 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\rest_ta\bin\rest.py"" Exception performing request: HTTPConnectionPool(host='localhost', port=15672): Max retries exceeded with url: /api/vhosts (Caused by <class 'socket.error'>: [Errno 10061] No connection could be made because the target machine actively refused it)

But I can't see these events in the Splunk serach. It would be great to combine succesful JSON data with another widget to monitor connectivity errors. Is this something I can do with this app, or do I need to indexc a new data source for this connection/service?

0 Karma

Damien_Dallimor
Ultra Champion

Any runtime errors (ie : messages that get written to splunkd.log) , are easily searchable in Splunk :

index=_internal ExecProcessor error rest.py

dolivasoh
Contributor

Within the input configuration in the Splunk UI there should be a check box for "Index Error Responses"alt text

0 Karma

rjlohan
Explorer

Yeah I've got that turned on but it doesn't seem to do anything in this case. Perhaps that handles explicit HTTP errors, but what if the service is completely down? In this case, I don't get HTTP error, I get connectivity faults, as noted in the log above.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...