topic Re: How to Schedule a search for every 30 seconds. in Reporting

How to Schedule a search for every 30 seconds.

nkchaitanya — Mon, 25 May 2015 11:02:18 GMT

I need to schedule a saved search for every 30 seconds, but I find the Basic one minute as the minimum schedule, which is also same in crons, please suggest is any other way to schedule for seconds.

Re: How to Schedule a search for every 30 seconds.

miteshvohra — Mon, 25 May 2015 11:19:20 GMT

AFAIK, cron does not go down to sub-minute resolutions/granularity.

Re: How to Schedule a search for every 30 seconds.

nkchaitanya — Mon, 25 May 2015 11:22:59 GMT

Thanks @miteshvohra,
Is there any way to schedule in seconds.

Re: How to Schedule a search for every 30 seconds.

woodcock — Mon, 25 May 2015 14:06:12 GMT

You cannot directly but you can run a CLI-based search on the search head so you can setup a cron job with 2 searches to run every second like this:

 * * * * * /my30SecondScript

And then inside my30SecondScript do something like this:

exec '/opt/splunk/bin/splunk search "my search string"'
sleep 30
exec '/opt/splunk/bin/splunk search "my search string"'

Re: How to Schedule a search for every 30 seconds.

hylam — Mon, 14 Dec 2015 04:45:29 GMT

Is it possible to make a "sleep 30" custom splunk command? Is it possible to make 2 copies of the same saved search, and then put a sleep 30 in one of them?

Re: How to Schedule a search for every 30 seconds.

woodcock — Mon, 14 Dec 2015 17:43:26 GMT

Splunk has a facility to create your own splunk commands but I have never done so so I cannot speak to that. You could to the latter which is the same as my solution but removing the first line of the script code that I wrote.

Re: How to Schedule a search for every 30 seconds.

hylam — Tue, 15 Dec 2015 00:42:50 GMT

Where do you put the my30SecondScript?

Re: How to Schedule a search for every 30 seconds.

woodcock — Tue, 15 Dec 2015 02:31:31 GMT

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/script

Re: How to Schedule a search for every 30 seconds.

hylam — Tue, 15 Dec 2015 02:45:43 GMT

Can I use the splunk job scheduler as a "highly available cron" to run arbitrary scripts? Splunk's job scheduler picks 1 of the search heads in an SHC to run a scheduled search. Splunk's job scheduler also prevents successive long running jobs to overlap.

Re: How to Schedule a search for every 30 seconds.

woodcock — Tue, 15 Dec 2015 02:53:18 GMT

Exactly the plan.

Re: How to Schedule a search for every 30 seconds.

znaesh — Thu, 27 Sep 2018 15:15:36 GMT

To have perfect run intervals, a user can append ampersand (&) before every such sleep command.