All Apps and Add-ons

Why does configuring a Response Handler in the REST API Modular Input break polling?

mlcooper7
New Member

I am trying to ingest some JSON from a REST endpoint that is an array in the form:
alt text

My goal is to make each element in the array a separate event in Splunk.

When I configure the REST API Modular Input endpoint with JSONArrayHandler for the Response Handler, it seems that polling breaks. I tail -f /opt/splunk/var/log/splunk/splunkd.log but it does not seem to ever poll. If I remove JSONArrayHandler from the Response Handler configuration, it does poll.

Config:
alt text

I am using https://splunkbase.splunk.com/app/1546/ version 1.4 and splunk enterprise 6.5.1.

Why does polling stop if I configure JSONArrayHandler for the Response Handler?

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Have you tried creating your own custom handler that is actually specific to your JSON format ?

View solution in original post

Damien_Dallimor
Ultra Champion

Have you tried creating your own custom handler that is actually specific to your JSON format ?

mlcooper7
New Member

I have not, no. I was under the impression that JSONArrayHandler would perhaps automatically make each item in the array a separate event in splunk. I read through the code for it, but unfortunately I can only read so much python. I could perhaps devise one if I saw an example of some JSON with its custom handler. I could probably manipulate it to fit the format of the JSON I'm working with.

0 Karma

mlcooper7
New Member

I'm not able to share my JSON due to its somewhat sensitive nature, however the FlightInfo example looks like it might sort of translate to the format of my JSON.

https://answers.splunk.com/answers/240659/how-to-troubleshoot-why-rest-api-modular-input-sto.html

0 Karma

mlcooper7
New Member

That worked! Each of the elements in my JSON is now a separate event in splunk. Thanks!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...