topic Re: How to Configure Sequential Searches... in Reporting

How to Configure Sequential Searches...

lpolo — Wed, 14 Mar 2012 14:07:48 GMT

I have 5 queries that have to be run in sequential order.
Is there a way in Splunk to schedule 5 searches like presented in the example?

Example:
Schedule Search 1 -> Runs every 2 hours.
Search 2 -> Runs after schedule search 1 is executed.
Search 3 -> Runs after search 2 is executed.
Search 4 -> Runs after search 3 is executed.
Search 5 -> Runs after search 4 is executed.

Any ideas will be appreciated.

Thanks,
Lp

Re: How to Configure Sequential Searches...

lguinn2 — Wed, 14 Mar 2012 22:19:32 GMT

Does each search have to wait until the prior search completes?

Re: How to Configure Sequential Searches...

lpolo — Thu, 15 Mar 2012 11:38:01 GMT

Yes. I have a sequential inter-dependency as I presented in the example.

Thanks.

Re: How to Configure Sequential Searches...

lpolo — Sat, 17 Mar 2012 11:38:32 GMT

I have been able to solve this problem in two ways.
1) By determining the max execution time of every scheduled search and then configure the schedule search time of each search accordingly. This approach has its limitations.

2) By creating a script that assures that the set of searches are executed in the define sequential order based on the result set data flow.

It will be nice if the user could use the search scheduler to define the execution order of a set scheduled searches base on the result set data flow as presented in the example.

Thanks.
Lp

Re: How to Configure Sequential Searches...

Ledion_Bitincka — Sat, 17 Mar 2012 20:19:28 GMT

The best way to solve this is through a script which has the flexibility of deciding when to dispatch the searches. You can decide whether to wait for a search to complete before dispatching the next one, or maybe dispatch a couple of them in parallel, or even modify a search based on the results of the previous search.

Re: How to Configure Sequential Searches...

reed_kelly — Thu, 12 Jul 2012 14:16:58 GMT

I agree that this would be a nice enhancement. We have created a lot of independant scheduled searches along with emails of attached CSV reports. We could convert it all to a script, but we have tried to do everything natively.