I am creating a modular REST API Input for my splunk add-on.
this API endpoint needs a date parameter which the value sent from add-on should be the last time this api endpoint was called by splunk, is there a way to save this value for my add-on?
so any time my splunk add-on calls the endpoint, i need this date to be overwritten and saved in the add-on for the next call.
Thanks a lot !
This app , https://splunkbase.splunk.com/app/1546/ , does what you want.
Plug in a custom response handler (mentioned in the docs) to save the date/time param.
Many examples of custom response handlers in rest_ta/bin/responsehandlers.py to get you started