when you setup your rest data input , it gets saved to an inputs.conf file in a [rest] stanza. Search for it under SPLUNK_HOME/etc/* what does it look like ? if we have some information to look at , we may be able to help you resolve your operating systems dns lookup failures. such as , perhaps you entered your hostname in your URL incorrectly ? ... View more

errno 11004 getaddrinfo failed : you have a DNS error. This is at the operating system level. The hostname can not be resolved. perhaps you are misconfiguring your rest stanza. please post your full rest stanza for the community to assist in troubleshooting. ... View more

If you google "errno 11004 getaddrinfo failed" you will see that you have hostname resolution errors. ... View more

These are internal calls to Spunk's management REST API , not outgoing calls. Also, these are not logs generated by the REST API Mod Input. A 404 is "not found". It would appear that Splunk is trying to find an internal rest endpoint for a "Storage01CPU" stanza that lives in the "falcon_host_api" app context. When you setup your REST stanzas , under what app/user context did you create them ? ie: look where the inputs.conf file lives (find/grep for it on your filesystem). ... View more

Yes , that is exactly what you can use the REST API Modular Input for. ... View more

As per the version 1.5.3 release notes , that is addressed. ... View more

That is a valid error. You have tried to run the Mod Input's script from the command line so it's Splunk session key (for REST callbacks to SplunkD) has expired. You would not get that error if you ran the Modular Input inside Splunk. ... View more

Any errors in the logs ? (search : index=_internal error amqp.py) What does your config look like ? (your amqp stanza in inputs.conf) ... View more

I'd guess that it's most likely a network/firewall blocking issue. ... View more

Yes , we provide support for that App , www.baboonbones.com/#support 🙂 ... View more

Well done 🙂 Also, FYI , our company provide formal commercial support for our offerings , www.baboonbones.com ... View more

I know nothing about uCMDB sorry. Perhaps trying tracing the requests on the network (wireshark etc..) and comparing what soapui sends vs what the rest mod input sends ie: compare the auth headers. ... View more

Nothing immediately comes to mind , are there any more log error lines after the example you showed ? Perhaps the auth POST failed and hence the "token" JSON key was not present in the response , and an error was thrown trying to access it. ... View more

Trying using our app , http://splunkbase.splunk.com/app/668/ , which is the original JMX App. ... View more

The answer is "it depends" on the specifics of your environment, message throughput/message size/any pre-processing/available compute resources etc... The way you are going about it is just fine...incrementally scale up by using approach (1) first. See what performance improvements you get, keep an eye on CPU and Memory usage. When you start to max out the performance achievable by approach (1) , then start to look at approach (2) and (3) to continue scaling horizontally as far as you need to reach your performance SLAs. ... View more

Is that XML above an example of what you want to be indexed ? ... View more

please read my answer below , polling_type is irrelevant (i wrote it). ... View more

Any log errors ? Try this search : index=_internal ExecProcessor error rest.py There is no externally configurable polling_type parameter in the REST Mod Input. There is only polling_interval The App automatically determines if this field is an integer or a cron pattern, sets an internal variable to indicate the type of polling and then executes the polling loop accordingly. If the polling_interval parameter is left blank , then it defaults to 60. So will poll your REST endpoint every minute. ... View more