The Python code in this App is dual 2.7/3 compatible. This version of the App enforces Python 3 for execution of the modular input script when running on Splunk 8+ in order to satisfy Splunkbase AppInspect requirements. If running this App on Splunk versions prior to 8 , then Python 2.7 will get executed.
This is a Splunk modular input add-on for polling REST APIs.
You require an activation key to use this App. Visit http://www.baboonbones.com/#activation to obtain a non-expiring key
The following authentication mechanisms are supported:
Settings -> Data Inputs -> REST
to add a new Input stanza via the UIREADME/inputs.conf.spec
. The inputs.conf
file should be placed in a local
directory under an App or User context.You can provide your own custom Authentication Handler. This is a Python class that you should add to the rest_ta/bin/authhandlers.py module.
http://docs.python-requests.org/en/latest/user/advanced/#custom-authentication
You can then declare this class name and any parameters in the REST Input setup page.
You can provide your own custom Response Handler. This is a Python class that you should add to the rest_ta/bin/responsehandlers.py module.
You can then declare this class name and any parameters in the REST Input setup page.
If you require an encrypted credential in your configuration , then you can enter it on the rest_ta
setup page.
Then in your configration stanza refer to it in the format {encrypted:somekey}
Where somekey
is any value you choose to enter on the setup page to refer to your credential.
endpoint = http://foo.com/{encrypted:somekey}
http_header_propertys = authkey={encrypted:somekey}
url_args = mysecret={encrypted:somekey}
There is support for dynamic token substitution in the endpoint URL
ie : /someurl/foo/$sometoken$/goo
$sometoken$ will get substituted with the output of the 'sometoken' function in bin/tokens.py
So you can add you own tokens simply by adding a function to bin/tokens.py
Currenty there is 1 token implemented , $datetoday$ , which will resolve to today's date in format "2014-02-18"
Token replacement functions in the URL can also return a list of values, that will cause multiple URL's to be formed and the requests for these URL's will be executed in parallel in multiple threads.
By default, certificate verification is disabled.
If you wish to enable certificate verification then you can provide the path to a CA Bundle file when setting up your REST stanza, or use the default bundled "certifi" CA Bundle.
More info on the CA Bundle File here , https://requests.readthedocs.io/en/master/user/advanced/#ssl-cert-verification
Modular Input logs will get written to $SPLUNK_HOME/var/log/splunk/restmodinput_app_modularinput.log
Setup logs will get written to $SPLUNK_HOME/var/log/splunk/restmodinput_app_setuphandler.log
These logs are rotated daily with a backup limit of 5.
The Modular Input logging level can be specified in the input stanza you setup. The default level is INFO
.
You can search for these log sources in the _internal
index or browse to the Logs
menu item on the App's navigation bar.
BaboonBones.com offer commercial support for implementing and any questions pertaining to this App.