I understand how the REST API works but I am lazy by default and have no intentions for creating over 1000 inputs. I want to use this http get https://www.badips.com/get/info/61.160.212.66
, to get info on a IP Address (61.160.212.66 is just an example IP Address). Is there a way for me to have IP Addresses saved on a csv file and then substitute the current ip address in the url with the csv file ip address. Therefore I can stream ip address info bout all of the ip address.Can this be done in input config is there a better of approaching this.
The REST API Modular input supports tokenization in the endpoint URL.
You can setup 1 single input and then parametize the URL with a token definition.
This token definition is a function in rest_ta/bin/tokens.py that you would write to return a list of IP addresses.
This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.
The REST API Modular input supports tokenization in the endpoint URL.
You can setup 1 single input and then parametize the URL with a token definition.
This token definition is a function in rest_ta/bin/tokens.py that you would write to return a list of IP addresses.
This would in effect spawn multiple HTTP requests running in parallel at a polling interval in seconds or on a CRON based schedule.
Consider looking at existing threatlist input implementations instead of re-inventing the wheel.
Do you have any recommendations.
This might be a start: https://splunkbase.splunk.com/apps/#/order/relevance/search/threat%2520list
Thank you very much
Are you possibly trying to re-create threatlist data sources?
You may want to build a streaming command using the SDK.
The SDK for Splunk?
In a way, yes.