Getting Data In

REST API Modular Input - Polling Interval is not working

jeromemarcotty
Engager

Hello Everyone,

I try to use the REST Api Input in my splunk account but i have an issue.
The "Polling Interval" value configuration seems not to work and the default value is not working either.

In fact the REST service i try to contact is flooded like hell with many request by seconds !
I try without any value, with a value in second, millisecond, nothing is working and my service keep to be flooded.

Can you help me with this ?

0 Karma

ryanoconnor
Builder

Unfortunately I can't get server-side error logs. I am trying to connect to the Nest API and don't have access to the server. I can successfully connect, but intervals do not seem to work at all. The only error I get is from rest.py:

11-01-2015 21:26:15.237 -0500 ERROR ExecProcessor - message from "python /Applications/Splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request:

I get this each time the client should be reaching out to pull down data.

If I restart Splunk or edit and save the input, the data comes down once and I enter the same broken state.

0 Karma

Damien_Dallimor
Ultra Champion

what does your inputs.conf stanza look like ?

0 Karma

ryanoconnor
Builder

[rest://Nest Devices]
auth_type = oauth2
endpoint = https://developer-api.nest.com/devices.json
http_method = GET
index_error_response_codes = 1
oauth2_access_token = TOKEN
oauth2_client_id = CLIENT_ID
oauth2_client_secret = CLIENT_SECRET
response_type = json
sequential_mode = 0
sourcetype = nest
streaming_request = 0
url_args = auth=TOKEN
polling_interval =

0 Karma

Damien_Dallimor
Ultra Champion

Do you have any errors in the logs ?

Search in Splunk with :

index=_internal ExecProcessor error rest.py

Do you have any errors on the server hosting the REST endpoint ?

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...