All Apps and Add-ons

Need to set report for 5 min of windows

rakesh44
Communicator

Hi Team,

I have report which run every minute, but job are going in waiting for queue job to start.

I have to set report to run every 5 minutes of windows

alt text

Tags (1)
0 Karma

MikaJustasACN
Path Finder

Pitching in, but not even 100% sure I understand the problem. When you say,
I have report which run every minute, but job are going in waiting for queue job to start.
Do you mean that if you schedule every 1 min (i.e. cron * * * * *) it doesnt run every minute? What is the runtime of that search? Is runtime of the search less than 1 minute? If no, then it will keep stacking and start falling behind the time.

0 Karma

rakesh44
Communicator

I have two correlation search and two report , both correlation search are schedule to run windows of 1 minute, and both report are schedule to run 5 min, so need to know is this approach is right

0 Karma

woodcock
Esteemed Legend

The cron expression controls when the scheduled search will run and is not something invented by splunk; here are 6 tools that you can use to learn about and create schedules:
https://www.tecmint.com/online-cron-job-generator-and-tester-for-linux/

The Timepicker setting in the Time range field controls the amount/span of data that will be searched, often relative to now (the point in time when the scheduled search runs). If you need Last 5 minutes, you are correct; there is no preset for this in the Presets section so go down to the Relative section and change the 15 number to a 5.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rakesh44,
It's not clear from your image if there are the needed spaces between stars, anyway the cron schedule is: */5 * * * *.

Ciao.
Giuseppe

0 Karma

rakesh44
Communicator

no need of space ,I have to set report to run every 5 minutes of windows

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rakesh44,
Sorry I wasn't clear: you should check if in your report cron expression (the field between Schedule and Time range buttons) there are spaces between stars, in other words: it seems */5****, instead it should be */5 * * * *.

Ciao.
Giuseppe

0 Karma

rakesh44
Communicator

yes it is set like that only , do I need to select scheduled window as well ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

No, you have only tho set (as you did) Run on Cron Schedule, set the correct cron schedule */5 * * * * (putting spaces between star chars), use the time range you need (it's indipendent by cron schedule) and leaving Schedule Priority and Schedule Window as default.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...