What is the best way to use the REST API to get info from almost identical url?

[syx093]

I understand how the REST API works but I am lazy by default and have no intentions for creating over 1000 inputs. I want to use this http get https://www.badips.com/get/info/61.160.212.66, to get info on a IP Address (61.160.212.66 is just an example IP Address). Is there a way for me to have IP Addresses saved on a csv file and then substitute the current ip address in the url with the csv file ip address. Therefore I can stream ip address info bout all of the ip address.Can this be done in input config is there a better of approaching this.

[Damien_Dallimor · Accepted solution]

The REST API Modular input supports tokenization in the endpoint URL.

You can setup 1 single input and then parametize the URL with a token definition.

This token definition is a function in rest_ta/bin/tokens.py that you would write to return a list of IP addresses.

This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.

[martin_mueller]

Consider looking at existing threatlist input implementations instead of re-inventing the wheel.

[syx093]

Do you have any recommendations.

[martin_mueller]

This might be a start: https://splunkbase.splunk.com/apps/#/order/relevance/search/threat%2520list

[syx093]

Thank you very much

[martin_mueller]

Are you possibly trying to re-create threatlist data sources?

[bmacias84]

You may want to build a streaming command using the SDK.

[syx093]

The SDK for Splunk?

[syx093]

In a way, yes.