All Apps and Add-ons

What is the best way to use the REST API to get info from almost identical url?

Communicator

I understand how the REST API works but I am lazy by default and have no intentions for creating over 1000 inputs. I want to use this http get https://www.badips.com/get/info/61.160.212.66, to get info on a IP Address (61.160.212.66 is just an example IP Address). Is there a way for me to have IP Addresses saved on a csv file and then substitute the current ip address in the url with the csv file ip address. Therefore I can stream ip address info bout all of the ip address.Can this be done in input config is there a better of approaching this.

1 Solution

Ultra Champion

The REST API Modular input supports tokenization in the endpoint URL.

You can setup 1 single input and then parametize the URL with a token definition.

This token definition is a function in rest_ta/bin/tokens.py that you would write to return a list of IP addresses.

This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.

alt text

alt text

View solution in original post

Ultra Champion

The REST API Modular input supports tokenization in the endpoint URL.

You can setup 1 single input and then parametize the URL with a token definition.

This token definition is a function in rest_ta/bin/tokens.py that you would write to return a list of IP addresses.

This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.

alt text

alt text

View solution in original post

SplunkTrust
SplunkTrust

Consider looking at existing threatlist input implementations instead of re-inventing the wheel.

Communicator

Do you have any recommendations.

0 Karma

SplunkTrust
SplunkTrust

Communicator

Thank you very much

0 Karma

SplunkTrust
SplunkTrust

Are you possibly trying to re-create threatlist data sources?

0 Karma

Champion

You may want to build a streaming command using the SDK.

0 Karma

Communicator

The SDK for Splunk?

0 Karma

Communicator

In a way, yes.

0 Karma