Getting Data In

REST API Modular Input add on stopped reading data

soumyasaha25
Contributor

i am using REST API Modular Input add on to ingest data from PRTG in JSON format which was working fine until yesterday when i tried to add some more configs to better process the data (props.conf and inputs.conf - a minor change in the endpoint). but strangely the data ingest stopped after the change, the endpoint query works fine since its working in the browser, checked splunkd logs as well there is nothing much that i can see from the time the data stopped coming in, did anyone face similar issues earlier?

this is my inputs.conf
[rest://PRTG_<IP>]
activation_key = <key>
auth_password = <username>
auth_type = basic
auth_user = <password>
endpoint = https://<IP>/api/table.json?content=sensors&output=json&columns=objid,probe,group,device,host,sensor,status,message,lastvalue,priority&count=100&username=<user>&passhash=<pass>
host = <ip>
http_method = GET
index = prtg
index_error_response_codes = 0
log_level = INFO
response_type = json
sequential_mode = 0
sourcetype = mysourcetype
streaming_request = 0
disabled = 0
this is the props.conf
[mysourcetype]
KV_MODE = JSON
Labels (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...