Hi
It seems to me that larger REST responses get cut off. Is there a configurable size limit on responses? Or is this the timeout setting?
What does the streaming_request option do?
BR
Henning
This is what I see on debug mode for the processing of the API response:
2020-12-02 13:48:29,640 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=std_output, code_line_no=187 | [stanza_name="SPLKTEST"] Writing events to stdout finished.
2020-12-02 13:48:29,638 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=engine.py, func_name=_on_post_process, code_line_no=170 | [stanza_name="SPLKTEST"] Got 2 tasks need to be executed after process
2020-12-02 13:48:29,638 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=models.py, func_name=calculate, code_line_no=243 | [stanza_name="SPLKTEST"] Calculated result: False
2020-12-02 13:48:29,637 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=json_path, code_line_no=98 | [stanza_name="SPLKTEST"] Got 1 elements extracted with JSONPATH expression "$"
2020-12-02 13:48:29,623 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=json_path, code_line_no=80 | [stanza_name="SPLKTEST"] source expected is a JSON, not <class 'str'>. Attempt to convert it to JSON
2020-12-02 13:48:29,622 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=_parse_json, code_line_no=199 | [stanza_name="SPLKTEST"] Try to extract JSON from source with JSONPATH expression: $,
2020-12-02 13:48:29,622 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=models.py, func_name=calculate, code_line_no=238 | [stanza_name="SPLKTEST"] Calculating condition with method: [json_empty], input size: [2]
2020-12-02 13:48:27,791 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=engine.py, func_name=_on_pre_process, code_line_no=154 | [stanza_name="SPLKTEST"] Got 0 tasks need be executed before process
Hello @paramagurukarth. I've tried the count=0 and it doesn't work for me.
If I put the api response on a text file, it does indexed perfectly. However, when using the rest api response (built with the add-on builder) it doesn't work. Any other suggestions?
Could it be something to do with asynchronous/synchronous api modes?
Thanks,
You will have to set the TRUNCATE property in props.conf for very large events.
See this answer here.
https://answers.splunk.com/answers/4162/size-limit-for-an-event.html
Send "count" as "0" along with your rest end point....
count parameter defines the number of entries...
count = 0 means everything 😛
i.e.
https://localhost:8089/servicesNS/-/MyApplication/data/ui/views?count=0