Splunk Alert Scheduling

[Kendo213]

index=winevents host=computernames* SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 | lookup ldap_identities.csv Sid OUTPUT identity | rename identity as User | stats count by User,host,_time | fields - count

There is an output lookup that runs once a day at 2AM to update the ldap_identities.csv file.

When reviewing the event log for the Alert, I'm seeing large gaps in time where I'm assuming it isn't running the job, but I don't see any failures. The time range is the last 5 minutes, with a cron schedule of */5 * * * *.

Can someone help me decipher what is going on in that job log? Why does it appear that there is a gap between May 24th 4:50 PM and May 25th 8:55 AM?

[somesoni2]

I would rather check the scheduler logs to see if the alert has run successfully or not.

index=_internal sourcetype=scheduler status=success savedsearch_name="Citrix Temporary Profile Login"

[Kendo213]

Thanks for the search. Yeah, it looks like it's running every 5 minutes. That job scheduler view is confusing.

[somesoni2]

Some jobs may get deleted (depending upon the house keeping jobs runs and dispatch directory size on the search head) so they don't show up in Jobs dashboard. If you're looking for something current, look at Jobs dashboard; for anything historical, look at scheduler logs.