All Apps and Add-ons

Where is auto saving checkpoints in Splunk addon builder checkpoint?


Splunk add-on builder gives us 2 options to save checkpoint

  1. File
  2. Auto

File type save checkpoints to /opt/splunk/var/lib/splunk/modinputs/

Where is auto saving checkpoints?

Labels (2)
0 Karma

Super Champion

Have a look at below add-on. I have implemented custom check points.

If this helps, give a like below.
0 Karma

Ultra Champion

So I just learnt something!

File uses a file checkpoint in the path you specify.

Auto stores the checkpoint in the KV Store

If my comment helps, please give it a thumbs up!


@nickhillscpl Thanks for your response and the document reference.

One additional thing, For file checkpoints I can delete checkpoints using below command

splunk clean inputdata

Is there a command to delete only kvstore checkpoints for specific input?

I know I am bothering you,but unable to locate these documents in Splunk.Thanks

0 Karma


I have the same question.  i found the kvstore in the collections.conf, but the only value are the dates.  how do we map the checkpoint to a specific value.  the value, i'm told for this add-on, matches the input name. 

0 Karma

Super Champion

Below is endpoint where all checkpoints are saved for an app


curl -v<applicationname>/storage/collections/data/<applicationname>_checkpointer/ -k -u admin:password


don't forget to change <applicationame> in the above url. 

To call specific checkpoing just add checkpoint key at the end of the above URL as show below:


curl -v<applicationname>/storage/collections/data/<applicationname>_checkpointer/<samplecheckpoint> -k -u admin:password


don't forget to change <applicationame> and <samplecheckpoint> in the above url. 

To update checkpoint:

curl -v -X "POST"<applicationname>/storage/collections/data/<applicationname>_checkpointer/batch_save -d '[{"_key": "<samplecheckpoint>", "state": "{\"end_date\": \"2022-01-01T00:00:00.000\"}"}]' -H "Content-Type: application/json" -k -u admin:password


be cautious with double quotes and escape characters used in -d parameter in the above curl statement. 


I also tried calling same endpoint from GUI as below, for some reason GUI is returning 0 results. 

| rest splunk_server=local /servicesNS/nobody/<applicationame>/storage/collections/data/<applicationame>_checkpointer/

If this helps, give a like below.
Get Updates on the Splunk Community!

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...