Is there an option to handle API returned json data using Addon Builder?
I want to sort a field in descending order and create a checkpoint against it.
API doesn't have a feature/Method to sort by field.
And one more question,if I do checkpoint using the sorted timestamp field, checkpoint always get events greater than the timestamp? Because API doesn't have a feature to include >timestamp field.
My requirement is:
Call the end point and index only unique values. Everytime I make a call , getting whole events again and again. The API is very basic and doesn't have some kind of filters and sorts.
There is a timestamp field exist in the results that I can use in search to get dedup values but the license consumption is lot since we are getting same data again and again.
You can bring all the data in, and | dedup your search in Splunk, or use some custom python code with Add-On Builder... its not "out of the box" per se, but add-on builder would allow you to setup that customization yourself.