All Apps and Add-ons

Data Concurrency while updating same csv files with multiple Alerts on same time.

sparachi
Engager

Hi Team,
I'm with another challenging issue.

I've a csv file ex: ABC.csv that being used in couple of schedulers(alerts) in splunk ex: update_ABC1, update_ABC2
As these alerts were scheduled to run at same time and want's to update results of schedules into ABC.csv file.
In this scenario only one scheduler ex: update_ABC1 is only actually appending its results to ABC.csv.

what i'm thinking of the issue is, file is getting locked by update_ABC1 and becoming deadlock so that data concurrency is not happening 🙂
work around i tried was scheduled both alerts with some time difference.

I'm currently using splunk enterprise 7.3.5, Is this a known bug for this version ?
Could anyone help in resolving issue?

0 Karma

PavelP
Motivator

Hello @sparachi,

you can use KVstore instead of local lookups, here is a comparison between them:

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/DefineaKVStorelookupinSplunkWeb

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...