All Apps and Add-ons

Data Concurrency while updating same csv files with multiple Alerts on same time.

sparachi
Engager

Hi Team,
I'm with another challenging issue.

I've a csv file ex: ABC.csv that being used in couple of schedulers(alerts) in splunk ex: update_ABC1, update_ABC2
As these alerts were scheduled to run at same time and want's to update results of schedules into ABC.csv file.
In this scenario only one scheduler ex: update_ABC1 is only actually appending its results to ABC.csv.

what i'm thinking of the issue is, file is getting locked by update_ABC1 and becoming deadlock so that data concurrency is not happening 🙂
work around i tried was scheduled both alerts with some time difference.

I'm currently using splunk enterprise 7.3.5, Is this a known bug for this version ?
Could anyone help in resolving issue?

0 Karma

PavelP
Motivator

Hello @sparachi,

you can use KVstore instead of local lookups, here is a comparison between them:

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/DefineaKVStorelookupinSplunkWeb

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...