All Apps and Add-ons

REST API Modular Input: How do I adjust the frequency the REST API makes HTTP requests?

bruce845
Explorer

I need that REST API makes HTTP requests only once a minute. How I make this?

This API makes many requests per minute. I don't need this. I can't adjust the frequency of requests.

I change the field "Sequential Stagger Time", but this doesn't do anything.

0 Karma

Damien_Dallimor
Ultra Champion

The polling interval parameter controls the frequency of requests.The default is 60 seconds.

As per the description in the UI :

alt text

If you are seeing more requests, then perhaps my guesses are :

1) you have errors , search with "index_internal ExecProcessor error rest.py" to find any
2) you have some other rest.py processes in the background doing things

0 Karma

bruce845
Explorer

So,

  1. I didn't find any erros. This API executes perfectly;
  2. When I disable, the requests stops immediately.

Below, the content of inputs.conf without some confidentiality attributes

[rest://RequestFresh]
auth_type = basic
http_header_propertys = Content-Type=application/json
http_method = GET
index = freshdesk
index_error_response_codes = 0
response_type = json
sequential_mode = 0
sourcetype = freshdesk
streaming_request = 0
url_args = format=json,page=1
disabled = 1
sequential_stagger_time = 
polling_interval = 600000
0 Karma

Damien_Dallimor
Ultra Champion

Are you performing token replacement in the URL ?

Also, just an observation 600000 should be 60 (seconds).

There was a typo in my error search string above , try this in Splunk:

index=_internal ExecProcessor error rest.py
0 Karma

bruce845
Explorer

Thank you for efforts on helping me, but:

I'm not perfoming token replacement.

I put 600000 for tests and other higher values, but the frequency of requests remains unchanged.

I tried this search query, but it didn't return any results. The app indexes responses perfectly, but tcpdump in Linux confirms the number of requests.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...