Hi all, I'm currently using the Modular REST API to pull data from a REST API which allows me to specify the earliest time for events through an argument in the URL. I'm using the dynamic token functionality to put a unix timestamp into the URL, all works well. My python code in tokens.py just gets the current linux time and takes 80 seconds from it. My interval is then set to 60 seconds and in theory I shouldn't lose any data from the API. However the REST API Add-on seems to always issue the same request to the API. If I restart splunk then it seems to update and the API call uses the correct time, however then it just keeps using the same time, although the Python code should be updating. Here's the Python code. def eightySecondsAgo(): unixEpochTimeNow = time.time() timeEightySecondsAgo = int(unixEpochTimeNow) - 80 return str(timeEightySecondsAgo) Any my inputs.conf [rest://Intercom_admin_events] activation_key = <redacted> endpoint=https://api.intercom.io/admins/activity_logs?created_at_after=$eightySecondsAgo$ http_header_propertys = authorization=Bearer <redacted>,accept=application/json,content-type=application/json http_method = GET auth_type= none response_type = json streaming_request=0 verify=0 sourcetype=intercom.admin.events polling_interval=60 It's like the dynamic token response is being cached or something? Really strange. Any ideas? ... View more

Hi all, I was previously tracking a new Add-on that Splunk were developing for ingesting Google Workspace "audit" data into Splunk. We're already using the excellent existing Add-on that's created by Kyle Smith, but were interested to see what the Splunk version would be like too. It looks like it was in a Beta, I could previously access it here: https://splunkbase.splunk.com/app/5556/#/details But all trace of it seems to have disappeared now!? Any ideas what happened to it? Thanks in advance, Stu ... View more

Hi all, We currently run Splunk within our own AWS environment (dedicated accounts) and separately have a variety of other AWS accounts running other production services. We want to use the AWS Add-on to pull AWS audit data from the various accounts into our Splunk instance. Our admins do not want to create IAM Users within the target AWS accounts if possible (as hardcoded credentials etc), but rather, as we run Splunk in AWS anyway, use AWS instance profiles. I can see this has been asked previously back in 2015/6 and it wasn't supported then, seems as we're 5 years on, I thought worth checking if that's still the case? Thanks, Stu ... View more