All Apps and Add-ons

Add-On Builder App not using Interval frequency

tdavison76
Path Finder

Hello,

I'm not sure how to troubleshoot this at all.  So I've created a new Python based App thru the Add-On builder that is using a Collection Interval every 60 sec.  The App Input is set to 60 sec as well.  When I test the script which makes chained API calls that creates events based off of the last API call, it returns within 20 sec.

The App would create about 50 events for each interval, when performing a Search, I would expect every 1 min to see about 50 events, but I'm seeing 6 or 7 per minute.  

I ran the following query, and it's showing that the event time and index time are within ms.  

source=netscaler| eval indexed_time=strftime(_indextime, "%Y-%m-%d %H:%M:%S") | eval event_time=strftime(_time, "%Y-%m-%d %H:%M:%S") | table _raw event_time indexed_time

When looking at the App log, I see it's only making the final API calls every 20 sec instead of all 50 of the final API calls within ms.

Does anyone have any idea why this would occur and how I could resolve this lag that is occurring?

 

Thanks for your help,

Tom

 

 

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...