All Apps and Add-ons

Checkpoints for Rest API input with Splunk Add-On Builder

evelenke
Contributor

Hi Splunkers,

I try to create an app with Add-on Builder, with the purpose to get records from JSON array.
As most of the records were created with the same timestamp and taking into account that there are thousands of records (so I have to make it partially), I try to use the startIndex=0 as initial record for a checkpoint with step (pageSize)=100.
What I'm expecting is with the next call it will move the checkpoint to an array record 99 and pull the other 100 and so on.
Here's the configuration:
url?startIndex=${start}&pageSize=100
JSON path=$.recordID (not an order-based value, just to use for breaking the data into individual events)
Checkpoint values:
Checkpoint parameter name = start
Checkpoint field path = [0]
Checkpoint initial value = 0

Test passed with no errors and returns records from array, but after saving - nothing is indexed.
What is wrong with this setup?

0 Karma

chli_splunk
Splunk Employee
Splunk Employee

Any error logs?

0 Karma

evelenke
Contributor

No any, looks like just grab nothing, according to the wrong but working configuration 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...