Data Concurrency while updating same csv files with multiple Alerts on same time.

[sparachi]

Hi Team,
I'm with another challenging issue.

I've a csv file ex: ABC.csv that being used in couple of schedulers(alerts) in splunk ex: update_ABC1, update_ABC2
As these alerts were scheduled to run at same time and want's to update results of schedules into ABC.csv file.
In this scenario only one scheduler ex: update_ABC1 is only actually appending its results to ABC.csv.

what i'm thinking of the issue is, file is getting locked by update_ABC1 and becoming deadlock so that data concurrency is not happening 🙂
work around i tried was scheduled both alerts with some time difference.

I'm currently using splunk enterprise 7.3.5, Is this a known bug for this version ?
Could anyone help in resolving issue?

[PavelP]

Hello @sparachi,

you can use KVstore instead of local lookups, here is a comparison between them:

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/DefineaKVStorelookupinSplunkWeb