All Apps and Add-ons

Where is auto saving checkpoints in Splunk addon builder checkpoint?


Splunk add-on builder gives us 2 options to save checkpoint

  1. File
  2. Auto

File type save checkpoints to /opt/splunk/var/lib/splunk/modinputs/

Where is auto saving checkpoints?

Labels (2)
0 Karma

Super Champion

Have a look at below add-on. I have implemented custom check points.

If this helps, give a like below.
0 Karma

Ultra Champion

So I just learnt something!

File uses a file checkpoint in the path you specify.

Auto stores the checkpoint in the KV Store

If my comment helps, please give it a thumbs up!


@nickhillscpl Thanks for your response and the document reference.

One additional thing, For file checkpoints I can delete checkpoints using below command

splunk clean inputdata

Is there a command to delete only kvstore checkpoints for specific input?

I know I am bothering you,but unable to locate these documents in Splunk.Thanks

0 Karma


I have the same question.  i found the kvstore in the collections.conf, but the only value are the dates.  how do we map the checkpoint to a specific value.  the value, i'm told for this add-on, matches the input name. 

0 Karma

Super Champion

Below is endpoint where all checkpoints are saved for an app


curl -v<applicationname>/storage/collections/data/<applicationname>_checkpointer/ -k -u admin:password


don't forget to change <applicationame> in the above url. 

To call specific checkpoing just add checkpoint key at the end of the above URL as show below:


curl -v<applicationname>/storage/collections/data/<applicationname>_checkpointer/<samplecheckpoint> -k -u admin:password


don't forget to change <applicationame> and <samplecheckpoint> in the above url. 

To update checkpoint:

curl -v -X "POST"<applicationname>/storage/collections/data/<applicationname>_checkpointer/batch_save -d '[{"_key": "<samplecheckpoint>", "state": "{\"end_date\": \"2022-01-01T00:00:00.000\"}"}]' -H "Content-Type: application/json" -k -u admin:password


be cautious with double quotes and escape characters used in -d parameter in the above curl statement. 


I also tried calling same endpoint from GUI as below, for some reason GUI is returning 0 results. 

| rest splunk_server=local /servicesNS/nobody/<applicationame>/storage/collections/data/<applicationame>_checkpointer/

If this helps, give a like below.
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...