https://community.splunk.com/t5/Reporting/Is-it-possible-to-sync-updates-to-index/m-p/394613#M6703 <P>The scenario:</P> <OL> <LI>via REST API, a scheduled search runs and updates an index, it adds values: Field1='A', Field2='1'; the splunk job is finished and finalized.</LI> <LI>via the REST API, the same scheduled search runs again and updates an index, it adds values: Field1='B', Field2='2'; the splunk job again is finished and finalized.</LI> <LI>another scheduled search runs and checks the content of the index ... but <STRONG>sometimes</STRONG> it only sees values Field1='A', Field2='1' ... it doesn't see the values submitted to the index the second time. When I run the same scheduled search a bit later, I already can see the values Field1='B', Field2='2'.</LI> </OL> <P>So, maybe it's a part of an optimization, but I would like to make sure in this particular case that when a job is done, the data is <STRONG>always</STRONG> available for another search after that.</P> <P>Is there a way as how to achieve that? Thanks for any help!</P> Mon, 22 Jul 2019 18:47:23 GMT jimams 2019-07-22T18:47:23Z https://community.splunk.com/t5/Reporting/Is-it-possible-to-sync-updates-to-index/m-p/394613#M6703 <P>The scenario:</P> <OL> <LI>via REST API, a scheduled search runs and updates an index, it adds values: Field1='A', Field2='1'; the splunk job is finished and finalized.</LI> <LI>via the REST API, the same scheduled search runs again and updates an index, it adds values: Field1='B', Field2='2'; the splunk job again is finished and finalized.</LI> <LI>another scheduled search runs and checks the content of the index ... but <STRONG>sometimes</STRONG> it only sees values Field1='A', Field2='1' ... it doesn't see the values submitted to the index the second time. When I run the same scheduled search a bit later, I already can see the values Field1='B', Field2='2'.</LI> </OL> <P>So, maybe it's a part of an optimization, but I would like to make sure in this particular case that when a job is done, the data is <STRONG>always</STRONG> available for another search after that.</P> <P>Is there a way as how to achieve that? Thanks for any help!</P> Mon, 22 Jul 2019 18:47:23 GMT https://community.splunk.com/t5/Reporting/Is-it-possible-to-sync-updates-to-index/m-p/394613#M6703 jimams 2019-07-22T18:47:23Z