topic Re: Monitor Job in Dashboard in Splunk Enterprise

How can I Monitor Jobs only at a specific interval in Dashboard?

Ashwini008 — Thu, 02 Mar 2023 15:36:26 GMT

Hi,

I need to monitor jobs only at specific interval .From Application server we are getting only Job Name And Date of Job generated into Splunk.

For example:

Job will only run between 9:30 PM -10:30 so Splunk will have data only after 9:30 PM so up to 9:30 PM dashboard will be showing as 'Job has not run' which is incorrect. I need to check only between 9:30 PM -10:30 PM and if there is no data in Index then show as "Job has not run"

Please suggest.

Re: Monitor Job in Dashboard

ITWhisperer — Thu, 02 Mar 2023 11:53:30 GMT

Not sure what the question is here - your search seems to append all the jobs from the csv which don't have entries in the time period of the search (although it could be optimised slightly since you are doing some date manipulation and then dropping the date field, and also filling the null dates with "N" only to replace it with "Job has not run"

Is the issue that job.csv does not include the expected times which the jobs should have been run between?

Re: Monitor Job in Dashboard

Ashwini008 — Thu, 02 Mar 2023 15:25:11 GMT

@ITWhisperer I need to monitor Jobs only at specific interval in dashboard. From source i am extracting job name and Timestamp of file generated. This Job generates anywhere between 9:30PM IST- 10:30PM IST . My below query is not checking for any time interval so before 9:30 PM also it is running the query and showing as "Job has not run". I need to check and run the query only after 9:30 PM and before that it should not run

Re: Monitor Job in Dashboard

ITWhisperer — Thu, 02 Mar 2023 12:35:29 GMT

So if I understand correctly, the report / dashboard search can be executed at any time but you want it ignore the fact that some jobs haven't been run (yet) if the time the job is executed is not between 9:30 and 10:30?

If so, how does the search know which jobs should be run in which timeframes?

Re: Monitor Job in Dashboard

Ashwini008 — Thu, 02 Mar 2023 14:39:10 GMT

@ITWhisperer That's correct. That is the challenge i am facing on how to check only specific jobs at specific interval. Can we write a query to check the condition only between 9:30 PM to 10: 30 PM

Re: Monitor Job in Dashboard

ITWhisperer — Thu, 02 Mar 2023 14:52:36 GMT

You could force your search to only return results (if there are any) when it is between certain times

| where now()>relative_time(now(),"@d+21h+30m") AND now()<relative_time(now(),"@d+22h+30m")

Re: Monitor Job in Dashboard

Ashwini008 — Thu, 02 Mar 2023 15:06:56 GMT

@ITWhisperer Thank You how do i exclude weekends from the query?

Re: Monitor Job in Dashboard

ITWhisperer — Thu, 02 Mar 2023 15:16:53 GMT

| where now()>relative_time(now(),"@d+21h+30m") AND now()<relative_time(now(),"@d+22h+30m") AND now()>relative_time(now(),"@w+1d") AND now()<relative_time(now(),"@w+6d")

Re: Monitor Job in Dashboard

Ashwini008 — Thu, 02 Mar 2023 15:21:55 GMT

@ITWhisperer I guess we can accept Answer only once per post! Anyway Thank You 🙂