The only case where I didn't have any value in my URL during my tests was because of the variable's format returned by the function. Did you try something like return str(myvalue) at the end of your function ? ... View more

Hi, If your token is not replaced with any value in the URL : What kind of function did you write in tokens.py ? Did you test it (for example by running tokens.py with a print instead of a return in the function) to check that the results are correct ? It should return only a single value (ex : 'zoo' ) or a list of values (ex : ['goo','foo','zoo'] ) Does your function have exactly the same name than your token ( def tokenName() ) ? If your token is replaced with a value the first time but is never updated : Did you restart splunk service after modifying the rest.py script ? Are you sure that your function in tokens.py returns different values each time it is called ? Which version are you using for the REST Modular Input App ? I tried this solution with success only on 1.4 and didn't test it on previous versions. ... View more

Hi, I encountered exactly the same issue and found another solution. Indeed, using custom response handler worked well to set URL arguments but I didn't find how to use it to set tokens in URL path (ex : http://myendpoint/api/$token$/search). After analyzing rest_ta/bin/rest.py, I found this part of the script, which is executed for each polling (begins at line 465 in version 1.4 of the REST Modular Input App) : while True: if polling_type == 'cron': next_cron_firing = cron_iter.get_next(datetime) while get_current_datetime_for_cron() != next_cron_firing: time.sleep(float(10)) for endpoint in endpoint_list: if "params" in req_args: req_args_params_current = dictParameterToStringFormat(req_args["params"]) else: (...) The problem is that the endpoint_list variable is set the first time the script runs, but is never updated after that. I added the functions used when the script starts, before the " for endpoint in endpoint_list " loop as below : while True: if polling_type == 'cron': next_cron_firing = cron_iter.get_next(datetime) while get_current_datetime_for_cron() != next_cron_firing: time.sleep(float(10)) original_endpoint=config.get("endpoint") #token replacement endpoint_list = replaceTokens(original_endpoint) for endpoint in endpoint_list: if "params" in req_args: req_args_params_current = dictParameterToStringFormat(req_args["params"]) else: (...) After that, tokens are always updated with tokens.py file before the REST API is polled. Damien, if the answer is correct, is it possible to update the rest.py script for the next version of the REST Modular Input App ? Thank you in advance, and sorry for my english, I didn't speak for a while 🙂 ... View more