Calling Splunk API to run a query and generate a report 3 hours after it is called?

Siri9996 — Mon, 24 Apr 2023 14:57:44 GMT

Hi All,

There is a requirement where a temporary cluster has to trigger Splunk API to run a command and generate a report. This cluster will have to trigger Splunk API right before it gets terminated. However, the Splunk API after called should only run 3 hours after its triggered and once the report is generated, the report should be sent via email and the process should be ended(Only once and not recurring every 3 hours).

This is because there is one log as part of that command which gets pushed 3 hours after the temporary cluster is terminated.(The data is not real-time).

I only have this option to automate because the call should be made by a cluster which is ready for termination only.

So how can I schedule a search to run 3 hours after its triggered to generate an report as an email?
Please let me know if there are any better options to achieve this.

Much awaiting for the suggestions. Thanks in Advance.

Re: Calling Splunk API to run a query and generate a report 3 hours after it is called?

PickleRick — Mon, 24 Apr 2023 15:33:59 GMT

If I understand you correctly, you want to make splunk wait 3 hours before executing some search.

Natively Splunk doesn't have a "delay" functionality.

You could try to "emulate" a counter by setting a value in a lookup and decrement it with a scheduled search and have an "optional execution" search implemented in another scheduled search.

topic Calling Splunk API to run a query and generate a report 3 hours after it is called? in Other Usage

Calling Splunk API to run a query and generate a report 3 hours after it is called?

Re: Calling Splunk API to run a query and generate a report 3 hours after it is called?