Before I go and re-invent the wheel, has anyone looked at indexing the results from the running an inspect using the CLI version of splunk-appinspect?
The --output-file is, by default, JSON and has a start_time field in it which could be used for the event's _time.
And, if you run it with --generate-feedback, then you get a YAML file which can be converted to JSON using the yq command. The result JSON file also has a start_time field in it which could be used for the event's _time.
As for a use-case... I don't know (yet). At this stage, it's really just a wouldn't it be cool to ...
