topic Re: Is there a way to "trigger" another search when previous saved search finished? in Reporting

Is there a way to "trigger" another search when previous saved search finished?

leo_systex — Wed, 11 Apr 2018 02:35:33 GMT

Is there a way to "trigger" another search when previous saved search finished?

I have a complicated jobs to run on splunk, so I separate it as two part :
One will generate a temporary lookup table , and the second one will use it.

Usually I configure them as two schedule search , and there is a buffer-time between them.
But the buffer-time is hard to decide, it depend on log volume and system performance at the execution time.
Sometime the second search run but the first search is not finish.
Sometime the first search run and rewrite the lookup table, but the previous second search is still running....
It cause wrong result for my report, and hard to trouble-shooting~

So I want to know if there any way to "trigger" another search when previous saved search finished?
So I could combined them as only one schedule job.

Or any idea to control the workflow on splunk?

Re: Is there a way to "trigger" another search when previous saved search finished?

deepashri_123 — Wed, 11 Apr 2018 05:29:56 GMT

Hey@leo_systex,

You can use something such as load job and run your search based on the result of load job.
Refer this link:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Loadjob

Let me know if this helps!!

Re: Is there a way to "trigger" another search when previous saved search finished?

ravicheepa — Wed, 11 Apr 2018 07:18:45 GMT

Did you try doing same thing using Subsearchs concept.
http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Aboutsubsearches

Let me know if works for you.

Re: Is there a way to "trigger" another search when previous saved search finished?

leo_systex — Fri, 13 Apr 2018 02:56:25 GMT

What I wanted is when the first search job done, "trigger" the second search job to run... How could I implement this idea by "loadjob" ?

Re: Is there a way to "trigger" another search when previous saved search finished?

leo_systex — Fri, 13 Apr 2018 03:01:36 GMT

Yes, I know the concept of subsearch. But there are some many limitation on subsearch ( Ex: number of return records. ) , I am processing a huge number of data, and the scenarios is not suit for subsearch.

Re: Is there a way to "trigger" another search when previous saved search finished?

ssadh_splunk — Sat, 29 Dec 2018 08:35:06 GMT

Have you checked the below answer:
https://answers.splunk.com/answers/614705/how-to-trigger-second-search-based-on-first-search.html