Hi there!
Funny you should ask, as I just started playing on this use case -- Splunking data from my Enphase system. The easiest way I know of to do what we want is to use the REST API Modular Input App -- see https://splunkbase.splunk.com/app/1546/#/details for details.
This will add a new data input method (you can browse from Settings -> Data -> Data Inputs) that provides a nice, simple UI for building the query. No need for curl scripts and cron jobs 😉
In my testing, I'm using the Enphase "stats" API call. Because Enphase wants time in epoch, you'll want to tweak the app's token.py ($SPLUNK_HOME/etc/apps/rest_ta/bin/token.py) to add a token for the current time (or some variant thereof, such as current time minus 5 minutes (the interval that Enphase supports for the stats command)) . In my case, I added the following:
import calendar
def epochdate():
# UTC format: timenow = datetime.datetime.utcnow()
timenow = datetime.datetime.now()
return calendar.timegm(timenow.timetuple())
Using "calendar" is the cleanest way I've found so far to do the conversion. I can then use the %epochdate% token in my config.
I am eager to hear how you fare with this project!
Happy Splunking!
