All Apps and Add-ons

Splunk Add-on Builder: How to setup a checkpoint for Team Viewer logs pull


HI guys

I am using the Splunk Add-on Builder to create an app that would fetch us logs from Team Viewer.

We can pull the connections logs by using a Rest API call, The issue is that we are getting open connections too so it is not possible for me to set up the path to the field that would act as a checkpoint, as in every pull it could be found somewhere else....

In the example screenshot, I am providing, the path to the value to be saved as checkpoint would be: records1.end_date but only because it is the second event, but it may be that the latest shown end_date is on the first event, the third one or somewhere else....

what can I do to save the date from the latest connection that was closed??

alt text

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!