All Apps and Add-ons

REST API Modular Input: How to poll a REST API at a specific time, every day?

jpanderson
Path Finder

I want to poll my REST endpoint at a specific time in the day, every day, at 3:00 AM to be precise.

I remember reading somewhere that the "Polling Interval" in Splunk for setting up REST endpoints can also take a time format, however I can't find the question or document which I originally read this in.

Currently we've got it set to poll daily (86400 seconds or something), however I am assuming this timer starts from the time the service is enabled. So if my assumption is true, it means I have to start every service at 3 in the morning, and disabling it and re-enabling it would completely ruin the timing.

Is there a way to specify a specific time to poll the service, not a simple polling interval.

Note: we do have settings on the REST end that can prevent requests outside of a specified time period from even going through, so technically I could leave it polling every 10 minutes and it wouldn't work outside of the allowed hours, but that would mean a lot of wasted requests during every other 10 minute period of the day.

1 Solution

jpanderson
Path Finder

Nevermind, I just found the answer.. Didn't look hard enough!

The format is "CRON format", funnily enough the other question wanted it at the exact same time period as me, the time for 3AM daily, is:

0 3 * * *

https://answers.splunk.com/answers/268306/rest-api-modular-input-v137-enhancements.html?sort=oldest

View solution in original post

sshres5
Communicator

My cron doesn't run for rest_ta polling, nor does time. Is anyone facing the same issue? I have dbconnect on the same host, and doesn't have any issues for its cron or time polling?

jpanderson
Path Finder

Nevermind, I just found the answer.. Didn't look hard enough!

The format is "CRON format", funnily enough the other question wanted it at the exact same time period as me, the time for 3AM daily, is:

0 3 * * *

https://answers.splunk.com/answers/268306/rest-api-modular-input-v137-enhancements.html?sort=oldest

jpanderson
Path Finder

That's 0 3 (asterisk) (asterisk) (asterisk)

The bold formatting code hidden by asterisks, and I can't edit my answer as I'm too low a rank!

0 Karma

ppablo
Retired

Glad you found your own answer 🙂 and no worries, it looks like Damien (the developer of the add-on) edited your answer for you appropriately 🙂 cheers.

Patrick

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...