topic Re: How scheduling works? in Splunk Search

How scheduling works?

lukasz92 — Wed, 17 Aug 2016 12:42:29 GMT

Hi,

I have a scheduled search that runs every 1 minute and it searches events on last 1 minute.

Will this search cover all future events?
If the search could start (for example) at 5:07:05 and than at 5:08:07 - are the data from (5:07:05 - 5:07:07) lost?

Re: How scheduling works?

skoelpin — Wed, 17 Aug 2016 12:51:47 GMT

What are you trying to accomplish with your scheduled search? Do you have an alert tied to this scheduled search?

You set the time window for 1 minute, so technically the data is not "lost", but the data is not available in your 1 minute window if it's older than 1 minute

Re: How scheduling works?

horsefez — Wed, 17 Aug 2016 12:53:11 GMT

Hi lukasz92,

there is a solution to your problem.

Try to apply the following settings to your alert

This will asure, that everything from 02:46:00 to 02:47:00 is covered. The alert is able to run between 02:47:00 and 02:47:59 and will still catch the data.

BUT, splunk takes time to index data... so data that reaches the machine on 02:46:59 might not be indexed by 02:47:00... so you should try to make like a little "window" for your alert to run in... do that in the Cron-Expression field.

Re: How scheduling works?

lukasz92 — Wed, 17 Aug 2016 13:28:07 GMT

Yes, Something like searching for custom events and alerting.

Technically I agree and understand - my question was about practice: how this does actually work.

Re: How scheduling works?

lukasz92 — Wed, 17 Aug 2016 13:30:23 GMT

it is a great solution. I have not thought about "@m".
Thanks!

Re: How scheduling works?

horsefez — Wed, 17 Aug 2016 16:20:24 GMT

Glad to help! 🙂