I just installed the Syndication Input add-on on my stand-alone search head and configured the answers.splunk.com/feed/questions.rss input as shown in the example. No data is showing in the dedicated index and running `index=_internal sourcetype="syndication_modular_input"` shows multiple records with this message:
"INFO Successfully retrieved feed entries, **count=0**, url=https://answers.splunk.com/feed/questions.rss"
So it says everything is fine, but there is nothing there. I tried both with and without credentials. Inputs.conf stanza in the search app looks like:
[syndication://Splunk Answers]
host = answers.splunk.com
include_only_changed = 1
index = training
interval = 1m
sourcetype = SplunkTraining-Answers
url = https://answers.splunk.com/feed/questions.rss
↧