All Apps and Add-ons

passing multivalue arguments rest_ta inputs

pmeyerson
Path Finder

I am trying out the rest_ta and having an issue trying to use a GET request with a multi-value argument.
The argument I want to pass is, "return_fields=comment,network"
I tried escaping with " or ', and also tried passing return_fields twice, one for each argument value. The first value was then dropped.

If I try to use "return_fields=comment,network" as either an url argument or http header property, I get the below error:

12-20-2017 17:17:12.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" http_header_propertys = dict((k.strip(), v.strip()) for k,v in
12-20-2017 17:17:12.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" ValueError: need more than 1 value to unpack

Can anyone point me in the right direction here? Is there some different escape format or do I need to head down a different direction? Appreciate any suggestions - just getting started with rest calls.

Tags (1)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

For return_fields=comment,network

change the delimiter to something other than a comma , such as a colon

alt text

View solution in original post

0 Karma

nikita_p
Contributor

Hi Pmeyerson,
Can you check below splunk docs for return command if it helps?
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Return

0 Karma

Damien_Dallimor
Ultra Champion

For return_fields=comment,network

change the delimiter to something other than a comma , such as a colon

alt text

0 Karma

pmeyerson
Path Finder

thanks, I misread the input page and didn't understand that, thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...