All Apps and Add-ons

Meraki Dashboard API works fine with Insomnia Rest Client but does not work with REST API Modular input

raynold_peterso
Path Finder

I am working on pulling the status and such of our Meraki AP's with the REST API Modular Input App for Splunk. Before I started configuring Splunk, I configured my Insomnia REST Client to pull,GET ,the data that I expect Splunk to pull. The Insomnia Client works just find with the following curl config:

curl --request GET \
--url https://api.meraki.com/api/v0/organizations/341515/deviceStatuses \
--header 'content-type: application/json' \
--header 'x-cisco-meraki-api-key: abcxyz......' \
--cookie BCSI-CS-cd9b29b41b5a35a5=2

output:

[
    {
        "name": "TXDADG-AP1",
        "serial": "Q2GD-C8Q2-XK4Y",
        "mac": "00:18:0a:ea:86:10",
        "publicIp": "192.251.189.86",
        "networkId": "L_568579452955526404",
        "status": "offline",
        "lanIp": "10.162.178.11"
    },
    {
        "name": "Brock-MX600",
        "serial": "Q2GN-2MQU-N2T8",
        "mac": "00:18:0a:02:c3:f0",
        "publicIp": "192.251.189.111",
        "networkId": "L_568579452955526404",
        "status": "online",
        "usingCellularFailover": false,
        "wan1Ip": "192.168.224.7",
        "wan2Ip": null
    }
]

All as expected. I think I am golden, but no.....It's not so....

I move to Splunk to configure the REST API Modular Input, which I have working for other inputs. Where is the non-working config:

[rest://Meraki Network Device Status]
activation_key = 3C3FA5F032624FA3CAD44F2D37F87A8B
auth_type = none
endpoint = http://dashboard.meraki.com/api/v0/organizations/341515/deviceStatuses
http_header_propertys = x-cisco-meraki-api-key="abcxyz......",content-type="application/json"
http_method = GET
http_proxy = UserId:Passwd@10.10.999.999:8080
https_proxy = UserId:Passwd@10.10.999.999:8080
index = meraki
index_error_response_codes = 1
polling_interval = */1 * * * *
response_type = json
sequential_mode = 0
sourcetype = meraki_status
streaming_request = 0
disabled = 0

I am getting in the splunkd log the following message:

http_error_code = 404 error_message =  

It appears that I am getting to the site but the requested page is not found.

Hmmmm, Its the same url request with the Insomnia Client as in the SMARTS Config.

What could be my stumbling block? Did I fat finger something?

Any help at this point would be very helpful.

Thanks in advance,
Rcp

Tags (1)
0 Karma

raynold_peterso
Path Finder

I tested it both ways with the same results. I get a 404 error with http or https.

Rcp

0 Karma

Damien_Dallimor
Ultra Champion

Your curl example is https , and in your Splunk REST config you are using http and a different URI. Possibe error ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...