topic Re: refresh cron schedule of a savesearch from cli/api in Splunk Enterprise

How to refresh cron schedule of a savesearch from cli/api?

schose — Fri, 21 Apr 2023 17:22:06 GMT

Hi all,

I have an testapp with a savesearch containing:

[testsearch] alert.suppress = 0 alert.track = 0 counttype = number of events cron_schedule = 1 * * * 1 dispatch.earliest_time = -7d@d dispatch.latest_time = -0d@d display.general.type = statistics display.page.search.mode = verbose display.page.search.tab = statistics enableSched = 1 quantity = 0 relation = greater than search = | makeresults

when i install the app using gui/api or commandline i see the schedule for next monday 1am. When i now change the schedule and settings to:

[testsearch] alert.suppress = 0 alert.track = 0 counttype = number of events cron_schedule = 5 * * * * dispatch.earliest_time = -16m@m dispatch.latest_time = -1m@m display.general.type = statistics display.page.search.mode = verbose display.page.search.tab = statistics enableSched = 1 quantity = 0 relation = greater than search = | makeresults

and checking by

| rest /servicesNS/-/testsearch/saved/searches | table title cron_schedule eai:acl.app cron_schedule next_scheduled_time | rename eai:acl.app as app | search title=*testsearch

i see that next_scheduled_time is still next monday. running a /debug/refresh or curl -k -u admin:XXX https://localhost:8089/servicesNS/nobody/testsearch/admin/localapps/_reload does not fix the issue. It seems only restarting the searchhead, wait until next schedule (multiple day in this case) or change using the gui fixes the issue.

In our case non of the above is possible, as we are deploying our apps using a cicd pipeline.

Any hint or workaround?

Best regards,

Andreas

Re: refresh cron schedule of a savesearch from cli/api

VatsalJagani — Thu, 20 Apr 2023 11:04:58 GMT

@schose - Few options, not sure which one you will be able to do.

Change from UI (SavedSearches, Reports, and Alerts page of Splunk)
- Will put the configuration in a local folder

Install the App through CLI
- This you can even do through your automation.
Install App through Splunk REST API
- https://community.splunk.com/t5/Getting-Data-In/Using-the-REST-API-to-install-an-app-from-a-file/td-p/149034?_ga=2.233768542.1328666194.1681972000-122114888.1681972000&_gl=1*12yprzd*_ga*MTIyMTE0ODg4LjE2ODE5NzIwMDA.*_ga_5EPM2P39FV*MTY4MTk4ODU2Mi4yLjEuMTY4MTk4ODU4MC40Mi4wLjA.

I hope this helps!! Kindly upvote if it does!!!

Re: refresh cron schedule of a savesearch from cli/api

schose — Mon, 24 Apr 2023 11:13:01 GMT

Hi @VatsalJagani ,

updating the app using REST API or GUI doesn't make a difference. We will open a call for this behaviour.

as a workaround it's possible to "version" your savedsearches -> putting 0001,2,3 at the end. Not very user friendly, but working.

best regards,

Andreas