Skip to main content

Hi Team,
I am currently working on one POC. I have created a Rest Collector, In the discovery section I have configured Crowdstrike API 1 which returns the list of resource ids. Post that, I am using a format discover results section to read all the resource ids one after the other in JS. These ids are dynamically passed to the query parameter of the next API 2 in the collect section. From API 2 response, I need to fetch an attribute related to device id and pass this attribute in the query parameter of the final API 3 whose response will be sent to the Splunk HEC destination. 

 I am currently not understanding how can I call this third API because Rest Collector doesn’t have  multiple collect sections and when I moved my data to pipeline to implement a code function to call the API 3, looks like its a limitation, I was not able to call external API from code function and I could not see any other functions in cribl that can support this. 
Is it possible to chain multiple Rest collectors, If yes, how can we trigger the second one synchronously.
I am looking forward to understanding what combinations I can use in order to proceed to call my final API 3.

Be the first to reply!