I've a csv file ex: ABC.csv that being used in couple of schedulers(alerts) in splunk ex: update_ABC1, update_ABC2
As these alerts were scheduled to run at same time and want's to update results of schedules into ABC.csv file.
In this scenario only one scheduler ex: update_ABC1 is only actually appending its results to ABC.csv.
what i'm thinking of the issue is, file is getting locked by update_ABC1 and becoming deadlock so that data concurrency is not happening 🙂
work around i tried was scheduled both alerts with some time difference.
I'm currently using splunk enterprise 7.3.5, Is this a known bug for this version ?
Could anyone help in resolving issue?