All Apps and Add-ons

Data Concurrency while updating same csv files with multiple Alerts on same time.

sparachi
Engager

Hi Team,
I'm with another challenging issue.

I've a csv file ex: ABC.csv that being used in couple of schedulers(alerts) in splunk ex: update_ABC1, update_ABC2
As these alerts were scheduled to run at same time and want's to update results of schedules into ABC.csv file.
In this scenario only one scheduler ex: update_ABC1 is only actually appending its results to ABC.csv.

what i'm thinking of the issue is, file is getting locked by update_ABC1 and becoming deadlock so that data concurrency is not happening 🙂
work around i tried was scheduled both alerts with some time difference.

I'm currently using splunk enterprise 7.3.5, Is this a known bug for this version ?
Could anyone help in resolving issue?

0 Karma

PavelP
Motivator

Hello @sparachi,

you can use KVstore instead of local lookups, here is a comparison between them:

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/DefineaKVStorelookupinSplunkWeb

0 Karma
Get Updates on the Splunk Community!

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

What's New in Splunk Observability - July 2025

What’s New?  We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what ...