Other Usage

How to schedule cron job for base report to run every 5 minutes outside specific hours?

tomapatan
Communicator

Hi,

I have a dashboard that runs off the back of a report that is scheduled to run every minute.
I need to amend the report schedule to run every minute between the specified hours AND every 5 minutes outside those hours to save on resources.

My current cron expression looks like this:

 

*/1 * * * *

 

To run every minute between the specified hours, I could write something like this.

 

*/1 3-8,12-20 * * *

 

The question I have is how to add a clause to schedule the search to run every 5 minutes outside those hours?

Many thanks. 

Labels (1)
0 Karma

GaetanVP
Contributor

Hello !

As @ITWhisperer suggested, you can use his complementary cron expression, but I think you will need to duplicate your first report.

Should do the work, good luck !

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

s other already said, you cannot add several schedules for one report. The real option is to duplicate that report and give to the both reports a separate schedules. Then you must update search query on both separately or try to use macro or maybe third savedsearch with loadjob can keep it on one place?

Are you absolutely sure that running this once a minute is something where your operative staff/other systems can react? In personally I try to avoid any schedule less than 5m or even 15minutes. 

Btw. have you using MC and look that you have enough resources to run this (and other) queries with this frequency? Are there skipped or deferred seaches?

r. Ismo

tomapatan
Communicator

Hi,

The operational requirement is to run the report every minute, but I`m thinking to propose to run it every 5 mins outside of busy operational times.
We do have enough resources to run the queries, but would still like to optimise the search and frequency as much as possible. 

Currently I`m using the report as a base search for my dashboard, but I`m not entirely sure how to call both of the reports, as suggested ?

Many thanks.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

*/5 0-2,9-11,21-23 * * *

Note that is has to be a separate cron schedule or you adapt your report to check whether the search time fits in the required time periods.

0 Karma

tomapatan
Communicator

Is it possible to add multiple cron schedules to a single base report ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I don't think that's possible although you might be able to use a saved search so both reports run from the same search.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...