Splunk Dev

Handling big json response from REST API when using REST API Modular Input

beetaj
Explorer

Hi all,

Our REST API response in json is quite big and chunky about 6000 line (more than 1000 items and about 200KB).
I need to use this endpoint to get data in.
In the Data Input REST settings, I have specified json as the source type.
The problem is that just a small portion of the json response is being present as an event, and the fields are not extracted correctly.
Therefore I cannot use the json data, spath is not wotking etc.

IS there a way to get around this, or I need to have a smaller json response.
Please help.
Thanks.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...