https://community.splunk.com/t5/Splunk-Search/Event-logs-to-metric-conversion-using-scheduled-search/m-p/657324#M227045 <P>We have got a requirement where, event logs need to be indexed under a metrics index. For this we are using mcollect command to ingest during search time.<BR /><BR />For automatic conversion, we have scheduled a search to run every 1 hour, but in case of missed schedule data is lost for that schedule.&nbsp;</P><P>What is the best way to store the last indexed time and run the schedule based on the last indexed time?</P><P>&nbsp;</P><P>&nbsp;</P><P class="">Note: In long run we will be using <A href="https://docs.splunk.com/Documentation/Splunk/9.1.1/Metrics/L2MSplunkWeb" target="_self">LogToMetrics</A> sourcetype for conversion, Until then we need to use the mcollect command.</P> Wed, 13 Sep 2023 10:30:21 GMT anand_p 2023-09-13T10:30:21Z https://community.splunk.com/t5/Splunk-Search/Event-logs-to-metric-conversion-using-scheduled-search/m-p/657324#M227045 <P>We have got a requirement where, event logs need to be indexed under a metrics index. For this we are using mcollect command to ingest during search time.<BR /><BR />For automatic conversion, we have scheduled a search to run every 1 hour, but in case of missed schedule data is lost for that schedule.&nbsp;</P><P>What is the best way to store the last indexed time and run the schedule based on the last indexed time?</P><P>&nbsp;</P><P>&nbsp;</P><P class="">Note: In long run we will be using <A href="https://docs.splunk.com/Documentation/Splunk/9.1.1/Metrics/L2MSplunkWeb" target="_self">LogToMetrics</A> sourcetype for conversion, Until then we need to use the mcollect command.</P> Wed, 13 Sep 2023 10:30:21 GMT https://community.splunk.com/t5/Splunk-Search/Event-logs-to-metric-conversion-using-scheduled-search/m-p/657324#M227045 anand_p 2023-09-13T10:30:21Z