This article applies to Splunk Enterprise customers.


Download/Install/Configure Splunk Enterprise

Download/Install/Configure Splunk REST API Modular Input v1.4

This is a Splunk Modular Input for polling REST APIs and indexing the responses.


Splunk 5.0+

Supported on Windows, Linux, MacOS, Solaris, FreeBSD, HP-UX, AIX


  • Untar the release to your $SPLUNK_HOME/etc/apps directory (recommend using 7zip for Windows users)
  • Restart Splunk
  • Browse to Manager -> Data Inputs -> REST and setup your inputs


Any modular input log errors will get written to $SPLUNK_HOME/var/log/splunk/splunkd.log


You are using Splunk 5+?

Look for any errors in $SPLUNK_HOME/var/log/splunk/splunkd.log?

Any firewalls blocking outgoing HTTP calls?

Are your REST URL, headers, url arguments correct?

Is your authentication setup correctly?

Making HTTP request

1. Create app token for calling TeamViewer API

  • Log into MCO ➜ Administer [Company Profile] ➜ Apps ➜ Create script token
    • Name: Splunk integration (your preference)
    • Description: Optional
    • Connection reporting: View connection entries

2. Please review TeamViewer’s API documentation page for further requests:

  • Log into the The Splunk web interface
  • Enter the appropriate fields:
    • Endpoint URL:
    • HTTP Method: GET
    • HTTP Header Properties: authorization=Bearer XXXXXX-XXXXXXXXXXXXXXXXX <- your token
    • Response Type: json
    • Polling interval: (optional as Splunk polls every 60 seconds)
    • Set sourcetype: Manual
    • Source type: _json
    • Save

3. Reviewing the results

  • In top left corner choose Apps ➜ Search & Reporting ➜ Data Summary ➜ Sources (middle tab) ➜ rest(“Name of report”)
  • Recommendation is to change from Raw view to Table view for meaning results

Following feedback from some of our great users, we would like to share that since Splunk may truncate the connection report JSON, it is advisable to limit the connection report to a specific time period.

The timestamp format is YYY-MM-DDTHH:MM:SSZ . An example connection report request URL with time constraints would be

More information about the TeamViewer Reporting API parameters can be found at

TeamViewer Reporting API, User Management API & Chat Widget