I have a IoT Device That has an Webserver Running.
then I open the webpage http://iot-device.local/data
I get an json response.
How do I get this response into Splunk?
I tried to setup HTTP Event collections but I think this is the opposite way...
I have done this quite a lot lately.
Either use a REST API addon, like https://splunkbase.splunk.com/app/1546/
or, like me, set up a logic app in Azure to handle it for you. It costs next to nothing.
https://docs.microsoft.com/en-us/azure/logic-apps/
I set it up to run an HTTP GET to the service, then an HTTP POST to Splunk with the results.
You are correct. HTTP Event Collector passively receives input from other sources. It doesn't reach out to fetch data.
Check for splunkbase for an app they may do what you seek. If you don't find one, it should be simple enough to write a scripted input that fetches the page at intervals.