REST Response Handler in Addon Builder.

[ansif]

Hi All,

Is there an option to handle API returned json data using Addon Builder?

I want to sort a field in descending order and create a checkpoint against it.

API doesn't have a feature/Method to sort by field.

And one more question,if I do checkpoint using the sorted timestamp field, checkpoint always get events greater than the timestamp? Because API doesn't have a feature to include >timestamp field.

My requirement is:

Call the end point and index only unique values. Everytime I make a call , getting whole events again and again. The API is very basic and doesn't have some kind of filters and sorts.

There is a timestamp field exist in the results that I can use in search to get dedup values but the license consumption is lot since we are getting same data again and again.

Thanks

[pmeyerson]

You can bring all the data in, and | dedup your search in Splunk, or use some custom python code with Add-On Builder... its not "out of the box" per se, but add-on builder would allow you to setup that customization yourself.

[damode]

Were you eventually get it fixed ?