How to get RSS data into splunk

[vrmandadi]

Is there an add-onn or way to get the RSS data for webex into splunk to know its health status? .I used https://splunkbase.splunk.com/app/2646/

Thanks in Advance

[asneed_eu]

There's an add-on on Splunkbase for ingesting generic RSS feeds.

https://splunkbase.splunk.com/app/2646/

[asneed_eu]

At first I used 5 minutes for testing.

I would try some other troubleshooting options just in case, like double checking the index (in my test environment it went to index=main), and the connectivity between the Splunk node and the RSS endpoint.

[vrmandadi]

Thanks.it went to index=main , I actually created a new index webex , but somehow it is overriding the sourcetype and index .Do you know how to change that

[asneed_eu]

I deleted my test environment, but if there's no option to set index through the UI for this app, it may have to be set in the inputs.conf file the app creates.

If this is still overwritten, it may need to be set with a transforms.conf index override (see this answer: https://answers.splunk.com/answers/100609/redirection-to-different-index-using-transforms-conf.html).

Hopefully the first option works.

[vrmandadi]

I installed the add-on and gave the URL https://status.webex.com/service/status?lang=en_US but I dont see any data.I have attached a screenshot of the input created in the question

[asneed_eu]

I saw that link in the top-right hand corner of the page you linked to in a previous comment -- It looks like a sort of global status feed for Webex, and it's in an rss format.

There's a black and white RSS icon in the corner.

[vrmandadi]

Ya.I see that .I tried using the same one but did not get data into Splunk .Should I create a new input or disable and enable the existing ? .What settings you have made in the input like time interval ,Include only new or changed entries,Convert HTML to Text

[asneed_eu]

I didn't have do do much configuration at all -- this was my input setup:

[567353544546456]

How do I get to that menu?

[vrmandadi]

I cant see the image you posted

[asneed_eu]

Try this url:

https://i.ibb.co/PhkCcnd/splunk-answers-ss.png

If it still doesn't work I'd recommend double checking your connectivity from the Splunk server in question to that webex rss url.

[vrmandadi]

Still not seeing .What is the interval setup on your input?

[asneed_eu]

In a test environment I was able to pull in data from this url:

https://status.webex.com/history.rss

Is this the data you're trying to pull in?

[vrmandadi]

What is the URL that you have used? .I used this URL https://status.webex.com/service/status?lang=en_US . If you see the URL that I sent ,you can see something like webex meeting , webex and it shows status operational .I am trying to get that data .Is that same as the URL you sent me or is it something different