All Apps and Add-ons

Splunk Add-on Builder: Checkpoint settings

deeptha1992
New Member

Hi,
I have configured one rest API for wireless network data and I thought it was working fine, but it is not giving all data from the wireless API to Splunk. There are actually 1000+ events but I am getting only 100 + events in Splunk.
I went through the documentation and saw that there is one checkpoint setting and tried to fill parameters for that.

"Checkpoint parameter name" as "Time" "Checkpoint field path" as "response.docs[0].Time"
"Checkpoint initial value" as "Checkpoint initial value"

I think my "response timestamp and request timestamp" are the same, so left that field as empty.

What changes do I need in my rest API URL for this?
And whether it will solve my actual problem?

Please help me.

Thanks in advance.

0 Karma

jnudell_2
Builder

Initially your checkpoint setting can be 0, and when the app runs, it will update it with the most recent checkpoint value (depending upon what you use as a checkpoint for this particular API.) Sometimes the API provides a uniquely identifying value that is an auto-increment numeric value. This will be the checkpoint, new events will have a value higher than the checkpoint value, and the API will return those based upon your API query logic.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...