All Apps and Add-ons

REST Response Handler in Addon Builder.


Hi All,

Is there an option to handle API returned json data using Addon Builder?

I want to sort a field in descending order and create a checkpoint against it.

API doesn't have a feature/Method to sort by field.

And one more question,if I do checkpoint using the sorted timestamp field, checkpoint always get events greater than the timestamp? Because API doesn't have a feature to include >timestamp field.

My requirement is:

Call the end point and index only unique values. Everytime I make a call , getting whole events again and again. The API is very basic and doesn't have some kind of filters and sorts.

There is a timestamp field exist in the results that I can use in search to get dedup values but the license consumption is lot since we are getting same data again and again.


0 Karma

Path Finder

You can bring all the data in, and | dedup your search in Splunk, or use some custom python code with Add-On Builder... its not "out of the box" per se, but add-on builder would allow you to setup that customization yourself.

0 Karma


Were you eventually get it fixed ?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!