topic Manually Trigger Scheduled Saved Search in Reporting

Manually Trigger Scheduled Saved Search

sondradotcom — Wed, 01 Dec 2010 22:56:53 GMT

I'm building some dashboards with panels that refer to scheduled saved searches. To be prudent, I'm scheduling the search to run once an hour. However, as I'm building the dashboard and tweaking the syntax for the saved search, I'd like to be able to manually run the saved search and have the results show up in the dashboard immediately. Right now the panel in the dashboard will only show the most recent scheduled saved search. So, for example:

1) I design a search, save it, schedule it to run hourly, create a dashbhoard, add it as a panel. It shows up -- great. 2) I go back and modify the saved search. Go back to dashboard. Panel still only shows first version of saved search. Must wait 1 hour to see changes.

So, I know I can just temporarily schedule the saved search to run every minute, but that seems inelegant. Is there a more elegant way to manually run a scheduled save search and see the results propagate across the dashboard panels that refer to that saved search?

Thanks! -S.

Re: Manually Trigger Scheduled Saved Search

MarioM — Thu, 02 Dec 2010 00:23:47 GMT

in Manager> Searches and Report in right and side of your saved search there is a Run which will run the search. Is it what you looking for?

Re: Manually Trigger Scheduled Saved Search

sondradotcom — Fri, 03 Dec 2010 03:30:45 GMT

I have tried that, but it doesn't seem to save this manually triggered search in such a way that it overwrites the most recent scheduled run of the same report (and therefore show up in the dashboards that refer to it...).

Re: Manually Trigger Scheduled Saved Search

Dan — Thu, 16 Dec 2010 07:29:03 GMT

Yeah, the scheduler has to run it to update the report artifact. I think this is an enhancement request that you should file by emailing your use case to support@splunk.com

Re: Manually Trigger Scheduled Saved Search

Jason — Wed, 20 Apr 2011 19:22:59 GMT

To get that first artifact, I always just schedule the search for 1 minute in the future via cron (example: it is now 3:23pm, set it for 24 15 * * *). Then I let it run, generate the saved artifact to check out in my dashboard, then when it's right I set it to the final schedule it needs to have.

Re: Manually Trigger Scheduled Saved Search

matthieu_araman — Thu, 11 Jun 2015 13:52:03 GMT

got the same need here.
running in the ui is not what I need.

Having a "shedule once now" link after "run" would be great.
It would allow :
- mail action when used
- for debug or after correcting a scheduled report, it is useful to relaunch it manually without losing the schedule (ie if it runs weekly on a particular day, it should not be changed in the report definition)
-report run in the background as a schedule process like if it was schedule in the future.

having to edit each report to change the cron for one run is painful (and you have to check that time didn't change while you're editing...)

Re: Manually Trigger Scheduled Saved Search

woodcock — Sat, 13 May 2017 13:08:55 GMT

It is not the same thing BUT this is almost as good for some cases: You can use the Summary Index backfill script from the CLI to fake runs over any period that you like so you can easily validate that it works the way that you expect:

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Managesummaryindexgapsandoverlaps

Re: Manually Trigger Scheduled Saved Search

samlinsongguo — Tue, 23 May 2017 04:07:12 GMT

In the schedule you can do run every hours/days/weeks.... and there is any optino run on cron schedule that is where you can make the report trigger in next min