All Apps and Add-ons

Where is auto saving checkpoints in Splunk addon builder checkpoint?

ansif
Motivator

Splunk add-on builder gives us 2 options to save checkpoint

  1. File
  2. Auto

File type save checkpoints to /opt/splunk/var/lib/splunk/modinputs/

Where is auto saving checkpoints?

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Have a look at below add-on. I have implemented custom check points.

https://splunkbase.splunk.com/app/5038/

————————————
If this helps, give a like below.
0 Karma

tomapatan
Communicator

Hi,

I wanted to import your add-on into the add-on builder so I can view the checkpoint logic and replicate it for my app, but I`m getting the following error when I try to import the project: "The add-on project could not be imported because a problem occurred while extracting project file."

Is there another way to view the checkpoint logic ?

Thanks, 

Toma

0 Karma

nickhills
Ultra Champion

So I just learnt something!

File uses a file checkpoint in the path you specify.

Auto stores the checkpoint in the KV Store
https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Usetheaddon#Configure_inputs

If my comment helps, please give it a thumbs up!

ansif
Motivator

@nickhillscpl Thanks for your response and the document reference.

One additional thing, For file checkpoints I can delete checkpoints using below command

splunk clean inputdata

Is there a command to delete only kvstore checkpoints for specific input?

I know I am bothering you,but unable to locate these documents in Splunk.Thanks

0 Karma

jaxjohnny2000
Builder

I have the same question.  i found the kvstore in the collections.conf, but the only value are the dates.  how do we map the checkpoint to a specific value.  the value, i'm told for this add-on, matches the input name. 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Below is endpoint where all checkpoints are saved for an app

 

curl -v https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/ -k -u admin:password

 

don't forget to change <applicationame> in the above url. 

To call specific checkpoing just add checkpoint key at the end of the above URL as show below:

 

curl -v https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/<samplecheckpoint> -k -u admin:password

 

don't forget to change <applicationame> and <samplecheckpoint> in the above url. 

To update checkpoint:

curl -v -X "POST" https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/batch_save -d '[{"_key": "<samplecheckpoint>", "state": "{\"end_date\": \"2022-01-01T00:00:00.000\"}"}]' -H "Content-Type: application/json" -k -u admin:password

reference: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/

be cautious with double quotes and escape characters used in -d parameter in the above curl statement. 

-----------

I also tried calling same endpoint from GUI as below, for some reason GUI is returning 0 results. 

| rest splunk_server=local /servicesNS/nobody/<applicationame>/storage/collections/data/<applicationame>_checkpointer/

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...