Splunk Dev

Handling big json response from REST API when using REST API Modular Input

beetaj
Explorer

Hi all,

Our REST API response in json is quite big and chunky about 6000 line (more than 1000 items and about 200KB).
I need to use this endpoint to get data in.
In the Data Input REST settings, I have specified json as the source type.
The problem is that just a small portion of the json response is being present as an event, and the fields are not extracted correctly.
Therefore I cannot use the json data, spath is not wotking etc.

IS there a way to get around this, or I need to have a smaller json response.
Please help.
Thanks.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...