Splunk REST API Modular Input v1.8.7

Overview

This is a Splunk modular input add-on for polling REST APIs.

Activation Key

You require an activation key to use this App. Visit http://www.baboonbones.com/#activation to obtain a non-expiring key

Features

Authentication

The following authentication mechanisms are supported:

Dependencies

Setup

Custom Authentication Handlers

You can provide your own custom Authentication Handler. This is a Python class that you should add to the rest_ta/bin/authhandlers.py module.

http://docs.python-requests.org/en/latest/user/advanced/#custom-authentication

You can then declare this class name and any parameters in the REST Input setup page.

Custom Response Handlers

You can provide your own custom Response Handler. This is a Python class that you should add to the rest_ta/bin/responsehandlers.py module.

You can then declare this class name and any parameters in the REST Input setup page.

Encryption of credentials

If you require an encrypted credential in your configuration , then you can enter it on the rest_ta setup page.

Browse to Apps -> Manage Apps -> rest_ta -> Setup

Then in your configration stanza refer to it in the format {encrypted:somekey}

Where somekey is any value you choose to enter on the setup page to refer to your credential.

EXAMPLES

Token substitution in Endpoint URL

There is support for dynamic token substitution in the endpoint URL

ie : /someurl/foo/$sometoken$/goo

$sometoken$ will get substituted with the output of the 'sometoken' function in bin/tokens.py

So you can add you own tokens simply by adding a function to bin/tokens.py

Currenty there is 1 token implemented , $datetoday$ , which will resolve to today's date in format "2014-02-18"

Token replacement functions in the URL can also return a list of values, that will cause multiple URL's to be formed and the requests for these URL's will be executed in parallel in multiple threads.

Certificate Verification

By default, certificate verification is disabled.

If you wish to enable certificate verification then you can provide the path to a CA Bundle file when setting up your REST stanza.

More info on the CA Bundle File here , https://requests.readthedocs.io/en/master/user/advanced/#ssl-cert-verification

Logging

Any log entries/errors will get written to $SPLUNK_HOME/var/log/splunk/splunkd.log

These are also searchable in Splunk : index=_internal error rest.py

Troubleshooting

Support

BaboonBones.com offer commercial support for implementing and any questions pertaining to this App.