Splunk add-on builder gives us 2 options to save checkpoint
File type save checkpoints to /opt/splunk/var/lib/splunk/modinputs/
Where is auto saving checkpoints?
Have a look at below add-on. I have implemented custom check points.
https://splunkbase.splunk.com/app/5038/
Hi,
I wanted to import your add-on into the add-on builder so I can view the checkpoint logic and replicate it for my app, but I`m getting the following error when I try to import the project: "The add-on project could not be imported because a problem occurred while extracting project file."
Is there another way to view the checkpoint logic ?
Thanks,
Toma
So I just learnt something!
File uses a file checkpoint in the path you specify.
Auto stores the checkpoint in the KV Store
https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Usetheaddon#Configure_inputs
@nickhillscpl Thanks for your response and the document reference.
One additional thing, For file checkpoints I can delete checkpoints using below command
splunk clean inputdata
Is there a command to delete only kvstore checkpoints for specific input?
I know I am bothering you,but unable to locate these documents in Splunk.Thanks
I have the same question. i found the kvstore in the collections.conf, but the only value are the dates. how do we map the checkpoint to a specific value. the value, i'm told for this add-on, matches the input name.
Below is endpoint where all checkpoints are saved for an app
curl -v https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/ -k -u admin:password
don't forget to change <applicationame> in the above url.
To call specific checkpoing just add checkpoint key at the end of the above URL as show below:
curl -v https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/<samplecheckpoint> -k -u admin:password
don't forget to change <applicationame> and <samplecheckpoint> in the above url.
To update checkpoint:
curl -v -X "POST" https://127.0.0.1:8089/servicesNS/nobody/<applicationname>/storage/collections/data/<applicationname>_checkpointer/batch_save -d '[{"_key": "<samplecheckpoint>", "state": "{\"end_date\": \"2022-01-01T00:00:00.000\"}"}]' -H "Content-Type: application/json" -k -u admin:password
reference: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/usetherestapitomanagekv/
be cautious with double quotes and escape characters used in -d parameter in the above curl statement.
-----------
I also tried calling same endpoint from GUI as below, for some reason GUI is returning 0 results.
| rest splunk_server=local /servicesNS/nobody/<applicationame>/storage/collections/data/<applicationame>_checkpointer/