All Apps and Add-ons

Why does configuring a Response Handler in the REST API Modular Input break polling?

mlcooper7
New Member

I am trying to ingest some JSON from a REST endpoint that is an array in the form:
alt text

My goal is to make each element in the array a separate event in Splunk.

When I configure the REST API Modular Input endpoint with JSONArrayHandler for the Response Handler, it seems that polling breaks. I tail -f /opt/splunk/var/log/splunk/splunkd.log but it does not seem to ever poll. If I remove JSONArrayHandler from the Response Handler configuration, it does poll.

Config:
alt text

I am using https://splunkbase.splunk.com/app/1546/ version 1.4 and splunk enterprise 6.5.1.

Why does polling stop if I configure JSONArrayHandler for the Response Handler?

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Have you tried creating your own custom handler that is actually specific to your JSON format ?

View solution in original post

Damien_Dallimor
Ultra Champion

Have you tried creating your own custom handler that is actually specific to your JSON format ?

mlcooper7
New Member

I have not, no. I was under the impression that JSONArrayHandler would perhaps automatically make each item in the array a separate event in splunk. I read through the code for it, but unfortunately I can only read so much python. I could perhaps devise one if I saw an example of some JSON with its custom handler. I could probably manipulate it to fit the format of the JSON I'm working with.

0 Karma

mlcooper7
New Member

I'm not able to share my JSON due to its somewhat sensitive nature, however the FlightInfo example looks like it might sort of translate to the format of my JSON.

https://answers.splunk.com/answers/240659/how-to-troubleshoot-why-rest-api-modular-input-sto.html

0 Karma

mlcooper7
New Member

That worked! Each of the elements in my JSON is now a separate event in splunk. Thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...