All Apps and Add-ons

[Splunk Add-On Builder] Checkpoint using wrong events from JSON

s2233
Explorer

I'm running into a strange issue with checkpointing--and it seems to have to do with the JSON array returning events in no clear order.

The REST URL I'm querying looks like this:

https://RESTURL.com/api/incidents?updated_after=2021-04-25T12:00:00Z 

Sample output:

 

 

[

{
"id":847,
"summary":"test",
"updated_at":"2021-04-25T12:23:57Z"

}

{

"id":842,
"summary":"test 2",
"updated_at":"2021-04-26T14:44:55Z"

}

]

 

 

If I try to use the "updated_at" time from the last event--using a "Checkpoint field path" like [-1].updated_at--the same event often stays as the last event in the array, even if there are others that are more up-to-date. So the checkpoint doesn't increment. (same issue if I try [0].updated_at )

So with something like the example above, the app will keep querying for updated_after=2021-04-26T14:44:55Z until the order of events happens to randomly change down the line.

Is there a way to use either "JSON path" or "Checkpoint field path" to find the event with the most recent "updated_at" time--and use that as the next checkpoint? Unfortunately there aren't any parameters (per the data source's API documentation) I can use in the REST URL to sort the JSON array.

Any help would be great. Thank you.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...