All Apps and Add-ons

Checkpoints for Rest API input with Splunk Add-On Builder


Hi Splunkers,

I try to create an app with Add-on Builder, with the purpose to get records from JSON array.
As most of the records were created with the same timestamp and taking into account that there are thousands of records (so I have to make it partially), I try to use the startIndex=0 as initial record for a checkpoint with step (pageSize)=100.
What I'm expecting is with the next call it will move the checkpoint to an array record 99 and pull the other 100 and so on.
Here's the configuration:
JSON path=$.recordID (not an order-based value, just to use for breaking the data into individual events)
Checkpoint values:
Checkpoint parameter name = start
Checkpoint field path = [0]
Checkpoint initial value = 0

Test passed with no errors and returns records from array, but after saving - nothing is indexed.
What is wrong with this setup?

0 Karma

Splunk Employee
Splunk Employee

Any error logs?

0 Karma


No any, looks like just grab nothing, according to the wrong but working configuration 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...