All Apps and Add-ons

Getting response from REST API URL but Splunk log says "503 error"

FIS1
Explorer

Hi,

I installed the REST API Modular Input app and when hitting a URL it returns this output "{"status":"DOWN"}". I would expect to see this in Splunk so I can create a dashboard, but its not in there. Looking at the logs it says the below.

08-29-2017 12:12:02.948 -0500 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\rest_ta\bin\rest.py"" HTTP Request error: 503 Server Error: Service Unavailable

Why can I pull the URL up in the browser and it shows that status down but the log says it received a server error? This is a local install of Splunk on my computer.

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

You received a 503 error response from the server and the error message is a JSON payload.

Only non error responses (ie: 200) get indexed.

By default , the REST Mod Input will only log error messages , not index any response data associated with them.

You would have to enable indexing of error responses in your config.

alt text

View solution in original post

0 Karma

Damien_Dallimor
Ultra Champion

You received a 503 error response from the server and the error message is a JSON payload.

Only non error responses (ie: 200) get indexed.

By default , the REST Mod Input will only log error messages , not index any response data associated with them.

You would have to enable indexing of error responses in your config.

alt text

0 Karma

khnkhurshid
New Member

Damien Dallimore,

could you please elaborate where to configure this,Itried thi but getting Unexpected character while looking for value: 'h' -

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...