Getting Data In

Add multiple similar REST endpoints under 1 data input

cdtinsley1
Observer

I am trying use REST API modular input in order to get data in Splunk from a REST endpoint. Unfortunately to get all the data I need to add data from an ever increasing number for URL's. Let me try to explain better.

https://[URL for the API]/ is a top level for the API. This contains common data for across each collection of information I need from the API. 1 piece of information contained in here is ID, this can be appended to the URL to bring back detailed information on that 1 thing. I can successfully get into Splunk from this with a very simply configuration

https://[URL for the API]/[ID]  this is the detailed information about 1 record in the top level of the API. Currently there are thousands of these and it is growing. So far I cannot find a way to get this data into Splunk without setting up individual data inputs for each 1.

Is there a way to get data from every ID sub page into Splunk through setting variables or wildcards in the configuration of a REST API modular data input, or am I on the wrong path and I need to take a completely different route to solving this?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...