After splunk job failed, we are unable to fetch the every 5 mins history data.

DKR1 — Fri, 01 Apr 2022 17:24:46 GMT

@links to members

'search earliest=-10m latest=now index= 'xyz'

(host=abcd123 or host=abcd345)

TxnStart2End| rex "Avg=(?<avgRspTime>\d+)" | rex "count=(?<count>\d+)" |timechart span=5m

sum(count) as Vol,

avg(avgrsptime) as "ART" | eval TPS=(vol/300) | table _time Vol Avgresptime TPS | sort_time'

the above query will fetch every 5 mins records so no worries but the issue is if the splunk job failed and run after half an hour for example:

suppose my job last run is 10:00am and it fetch records until 10:00 AM for every 5 mins spam.

my job got failed at 10:01 am and it will run again at 11:00 am, but in between 10:01 am to 11:00 am data is missing ( so my requirement is I need missing data in the spam of for every 5 mins)

i.e 10:05 data, 10:10 data ...10:50, 10:55 and 11:00 data..

please help with correct query.

Re: After splunk job failed, we are unable to fetch the every 5 mins history data.

somesoni2 — Fri, 01 Apr 2022 18:12:25 GMT

How frequently your Splunk job runs (cron schedule)? What do you do with generated report?

topic Re: After splunk job failed, we are unable to fetch the every 5 mins history data. in Splunk Search

After splunk job failed, we are unable to fetch the every 5 mins history data.

Re: After splunk job failed, we are unable to fetch the every 5 mins history data.