topic Re: Run searchname returned from a scheduled query as a new search in Splunk Search

Run searchname returned from a scheduled query as a new search

Mag2sub — Wed, 30 Apr 2014 04:37:44 GMT

We have a a scheduled query that returns certain search names ...how do we automate such that the scheduled query that returns certain search names automatically runs those searches again ?
Appreciate inputs!

Re: Run searchname returned from a scheduled query as a new search

martin_mueller — Wed, 30 Apr 2014 08:04:32 GMT

Say your search returns a row per to-be-run saved search names in the field search, then you can run those using map:

your scheduled search returning a field search per row | map search="savedsearch $search$"

Re: Run searchname returned from a scheduled query as a new search

Mag2sub — Wed, 30 Apr 2014 11:59:25 GMT

Now the scheduled search is returning some scheduled distributed search names which had at that schedule time lost connection with peer...when we use map wont it run the same search using a system time for schedule ...while we wanted the time the connectivity was lost as the schedule time ...how can we do the same ?

Re: Run searchname returned from a scheduled query as a new search

martin_mueller — Wed, 30 Apr 2014 12:37:02 GMT

What are those saved searches doing? Summary Indexing? Alerting? Reporting? ...?

Re: Run searchname returned from a scheduled query as a new search

Mag2sub — Wed, 30 Apr 2014 13:09:07 GMT

Alerting searches

Re: Run searchname returned from a scheduled query as a new search

martin_mueller — Wed, 30 Apr 2014 23:00:09 GMT

In that case time ranges and alert actions matter a lot as well - that complicates things a lot, I don't think there's a reasonable fully automatic one-search solution to that.

Re: Run searchname returned from a scheduled query as a new search

Mag2sub — Fri, 09 May 2014 14:50:39 GMT

Can we use the backfill summary index script without summary action and modify for alerts ?