All Apps and Add-ons
Highlighted

Splunk Add-on Builder: Checkpoint settings

New Member

Hi,
I have configured one rest API for wireless network data and I thought it was working fine, but it is not giving all data from the wireless API to Splunk. There are actually 1000+ events but I am getting only 100 + events in Splunk.
I went through the documentation and saw that there is one checkpoint setting and tried to fill parameters for that.

"Checkpoint parameter name" as "Time" "Checkpoint field path" as "response.docs[0].Time"
"Checkpoint initial value" as "Checkpoint initial value"

I think my "response timestamp and request timestamp" are the same, so left that field as empty.

What changes do I need in my rest API URL for this?
And whether it will solve my actual problem?

Please help me.

Thanks in advance.

0 Karma
Highlighted

Re: Splunk Add-on Builder: Checkpoint settings

Builder

Initially your checkpoint setting can be 0, and when the app runs, it will update it with the most recent checkpoint value (depending upon what you use as a checkpoint for this particular API.) Sometimes the API provides a uniquely identifying value that is an auto-increment numeric value. This will be the checkpoint, new events will have a value higher than the checkpoint value, and the API will return those based upon your API query logic.

0 Karma