All Apps and Add-ons

[Splunk Add-On Builder] Checkpoint using wrong events from JSON

s2233
Explorer

I'm running into a strange issue with checkpointing--and it seems to have to do with the JSON array returning events in no clear order.

The REST URL I'm querying looks like this:

https://RESTURL.com/api/incidents?updated_after=2021-04-25T12:00:00Z 

Sample output:

 

 

[

{
"id":847,
"summary":"test",
"updated_at":"2021-04-25T12:23:57Z"

}

{

"id":842,
"summary":"test 2",
"updated_at":"2021-04-26T14:44:55Z"

}

]

 

 

If I try to use the "updated_at" time from the last event--using a "Checkpoint field path" like [-1].updated_at--the same event often stays as the last event in the array, even if there are others that are more up-to-date. So the checkpoint doesn't increment. (same issue if I try [0].updated_at )

So with something like the example above, the app will keep querying for updated_after=2021-04-26T14:44:55Z until the order of events happens to randomly change down the line.

Is there a way to use either "JSON path" or "Checkpoint field path" to find the event with the most recent "updated_at" time--and use that as the next checkpoint? Unfortunately there aren't any parameters (per the data source's API documentation) I can use in the REST URL to sort the JSON array.

Any help would be great. Thank you.

Labels (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...