Where is auto saving checkpoints in Splunk addon builder checkpoint?

[ansif]

Splunk add-on builder gives us 2 options to save checkpoint

1. File
2. Auto

File type save checkpoints to /opt/splunk/var/lib/splunk/modinputs/

Where is auto saving checkpoints?

[thambisetty]

Have a look at below add-on. I have implemented custom check points.

https://splunkbase.splunk.com/app/5038/

[nickhills]

So I just learnt something!

File uses a file checkpoint in the path you specify.

Auto stores the checkpoint in the KV Store
https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Usetheaddon#Configure_inputs

[ansif]

@nickhillscpl Thanks for your response and the document reference.

One additional thing, For file checkpoints I can delete checkpoints using below command

splunk clean inputdata

Is there a command to delete only kvstore checkpoints for specific input?

I know I am bothering you,but unable to locate these documents in Splunk.Thanks

[jaxjohnny2000]

I have the same question.  i found the kvstore in the collections.conf, but the only value are the dates.  how do we map the checkpoint to a specific value.  the value, i'm told for this add-on, matches the input name. 

[thambisetty]

Below is endpoint where all checkpoints are saved for an app

curl -v https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/ -k -u admin:password

don't forget to change <applicationame> in the above url. 

To call specific checkpoing just add checkpoint key at the end of the above URL as show below:

curl -v https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/<samplecheckpoint> -k -u admin:password

don't forget to change <applicationame> and <samplecheckpoint> in the above url. 

To update checkpoint:

curl -v -X "POST" https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/batch_save -d '[{"_key": "<samplecheckpoint>", "state": "{\"end_date\": \"2022-01-01T00:00:00.000\"}"}]' -H "Content-Type: application/json" -k -u admin:password

reference: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/

be cautious with double quotes and escape characters used in -d parameter in the above curl statement. 

-----------

I also tried calling same endpoint from GUI as below, for some reason GUI is returning 0 results. 

| rest splunk_server=local /servicesNS/nobody/<applicationame>/storage/collections/data/<applicationame>_checkpointer/