All Apps and Add-ons

Checkpoints for Rest API input with Splunk Add-On Builder

evelenke
Contributor

Hi Splunkers,

I try to create an app with Add-on Builder, with the purpose to get records from JSON array.
As most of the records were created with the same timestamp and taking into account that there are thousands of records (so I have to make it partially), I try to use the startIndex=0 as initial record for a checkpoint with step (pageSize)=100.
What I'm expecting is with the next call it will move the checkpoint to an array record 99 and pull the other 100 and so on.
Here's the configuration:
url?startIndex=${start}&pageSize=100
JSON path=$.recordID (not an order-based value, just to use for breaking the data into individual events)
Checkpoint values:
Checkpoint parameter name = start
Checkpoint field path = [0]
Checkpoint initial value = 0

Test passed with no errors and returns records from array, but after saving - nothing is indexed.
What is wrong with this setup?

0 Karma

chli_splunk
Splunk Employee
Splunk Employee

Any error logs?

0 Karma

evelenke
Contributor

No any, looks like just grab nothing, according to the wrong but working configuration 🙂

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...