I am trying to ingest some JSON from a REST endpoint that is an array in the form:
My goal is to make each element in the array a separate event in Splunk.
When I configure the REST API Modular Input endpoint with JSONArrayHandler for the Response Handler, it seems that polling breaks. I
tail -f /opt/splunk/var/log/splunk/splunkd.log but it does not seem to ever poll. If I remove JSONArrayHandler from the Response Handler configuration, it does poll.
I am using https://splunkbase.splunk.com/app/1546/ version 1.4 and splunk enterprise 6.5.1.
Why does polling stop if I configure
JSONArrayHandler for the Response Handler?
I have not, no. I was under the impression that JSONArrayHandler would perhaps automatically make each item in the array a separate event in splunk. I read through the code for it, but unfortunately I can only read so much python. I could perhaps devise one if I saw an example of some JSON with its custom handler. I could probably manipulate it to fit the format of the JSON I'm working with.
I'm not able to share my JSON due to its somewhat sensitive nature, however the FlightInfo example looks like it might sort of translate to the format of my JSON.