Changing the Data Format and Stream Position

In the top navigation bar, click Settings > Data Input, then click Scripts.
Click the $SPLUNK_HOME/etc/apps/lookout/bin/main.py link in the Command column to open the Lookout script for editing:

Modify the following as needed:


Field	Format	Description
Interval	integer / cron job	The interval for fetching events. Defaults to 60s if left unset. You can set this either in seconds, or in cron job format as documented at https://crontab.guru/
Source name override	String	The value to use for the `source` field, instead of `lookout`.


Changing the `streamPosition`

streamPosition is an integer value used by Lookout's Mobile Risk API. A request with no streamPosition, or streamPosition=0 tells the API to return the earliest events. Any other streamPosition tells the API to return the events that follow that streamPosition.

The Lookout app fetches events for the API key you provide, starting from streamPosition=0. If you need to modify the streamPosition directly, you can modify the value in the Splunk Key-Value store:

In the top navigation bar, click Datasets, then select lookout_kvstore.
In the upper right corner, click Edit > Extend in Table.
In the top menu, click Clean > Replace Values and modify the streamPosition as needed:

Lookout Product Documentation

Find answers about using and optimizing Lookout products.

Changing the Data Format and Stream Position

lookout-footer