All Apps and Add-ons

What is the best way to use the REST API to get info from almost identical url?

syx093
Communicator

I understand how the REST API works but I am lazy by default and have no intentions for creating over 1000 inputs. I want to use this http get https://www.badips.com/get/info/61.160.212.66, to get info on a IP Address (61.160.212.66 is just an example IP Address). Is there a way for me to have IP Addresses saved on a csv file and then substitute the current ip address in the url with the csv file ip address. Therefore I can stream ip address info bout all of the ip address.Can this be done in input config is there a better of approaching this.

1 Solution

Damien_Dallimor
Ultra Champion

The REST API Modular input supports tokenization in the endpoint URL.

You can setup 1 single input and then parametize the URL with a token definition.

This token definition is a function in rest_ta/bin/tokens.py that you would write to return a list of IP addresses.

This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.

alt text

alt text

View solution in original post

Damien_Dallimor
Ultra Champion

The REST API Modular input supports tokenization in the endpoint URL.

You can setup 1 single input and then parametize the URL with a token definition.

This token definition is a function in rest_ta/bin/tokens.py that you would write to return a list of IP addresses.

This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.

alt text

alt text

martin_mueller
SplunkTrust
SplunkTrust

Consider looking at existing threatlist input implementations instead of re-inventing the wheel.

syx093
Communicator

Do you have any recommendations.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

syx093
Communicator

Thank you very much

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you possibly trying to re-create threatlist data sources?

0 Karma

bmacias84
Champion

You may want to build a streaming command using the SDK.

0 Karma

syx093
Communicator

The SDK for Splunk?

0 Karma

syx093
Communicator

In a way, yes.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...