Hello,
So I have successfully created a custom REST API Endpoint for my Splunk App by creating a stanza in restmap.conf, exposing it in web.conf, and placing an appropriate persistent python handler in bin. I have this working successfully, but I have run into two issues:
1.) I'm attempting to use Invoke-RestMethod in Powershell 5.1 to run my custom endpoint. If I call one of my custom endpoints that use POST, it works correctly. If I call one of the endpoints that use GET, it fails with "The underlying connection was closed: An unexpected error occurred on a send." If I call one of the POST endpoints followed by the GET endpoint, both calls work correctly. If I call the GET endpoint on its own using [System.Net.WebRequest] instead of Invoke-RestMethod, it works properly.
Does anyone know what may be going on here? The server is a default installation of Splunk with my app installed. The url is https with no explicit certs created by me. I have disabled SSL verification via [System.Net.ServicePointManager]::ServerCertificateValidationCallback to ensure the calls work properly. It seems to me like the success of the POST command results in some successful negotiation between the client and the server that allows subsequent (in the same session of Powershell) GET calls to work when they fail on their own. But that is really strange behavior I have not seen with Invoke-RestMethod with other products.
2.) In web.conf for my expose staza, I set "methods=GET". However despite setting this, a POST command (called via Invoke-RestMethod in Powershell 5.1) will successfully run for the endpoint. I assume this is Splunk improperly enforcing the methods I have exposed, but maybe there is some nuance I am missing?
Thank you for any help you can provide.
