All Apps and Add-ons

Splunk Add-on Builder: How to setup a checkpoint for Team Viewer logs pull

Engager

HI guys

I am using the Splunk Add-on Builder to create an app that would fetch us logs from Team Viewer.

We can pull the connections logs by using a Rest API call, The issue is that we are getting open connections too so it is not possible for me to set up the path to the field that would act as a checkpoint, as in every pull it could be found somewhere else....

In the example screenshot, I am providing, the path to the value to be saved as checkpoint would be: records1.enddate but only because it is the second event, but it may be that the latest shown enddate is on the first event, the third one or somewhere else....

what can I do to save the date from the latest connection that was closed??

alt text