HI guys
I am using the Splunk Add-on Builder to create an app that would fetch us logs from Team Viewer.
We can pull the connections logs by using a Rest API call, The issue is that we are getting open connections too so it is not possible for me to set up the path to the field that would act as a checkpoint, as in every pull it could be found somewhere else....
In the example screenshot, I am providing, the path to the value to be saved as checkpoint would be: records1.end_date but only because it is the second event, but it may be that the latest shown end_date is on the first event, the third one or somewhere else....
what can I do to save the date from the latest connection that was closed??
