All Apps and Add-ons

Search is "scheduled", but shows no schedule in manager and didn't run

sowings
Splunk Employee
Splunk Employee

I've recently installed the Fire Brigade app on a new single-instance Splunk, running version 5. The saved searches didn't fire overnight, and I'm wondering why. I went into the Manager > Searches and Reports, and saw that the "scheduled time" field for the searches were all blank. Thinking that this must have been an installation snafu, I clicked on the search to enable a schedule. What I found was that it was already showing as scheduled, with the correct time. Despite this, it hadn't run.

Any hints?

alt text

1 Solution

sowings
Splunk Employee
Splunk Employee

The issue was observed in 5.0. Since upgrading the system to 5.0.4, the app's searches show as scheduled, and everything seems OK.

View solution in original post

sowings
Splunk Employee
Splunk Employee

The issue was observed in 5.0. Since upgrading the system to 5.0.4, the app's searches show as scheduled, and everything seems OK.

hexx
Splunk Employee
Splunk Employee

You could at least upvote my comments 🙂

0 Karma

sowings
Splunk Employee
Splunk Employee

Upgrading to 5.0.4 has ... vanished the problem.

0 Karma

hexx
Splunk Employee
Splunk Employee

If this is occurring in the latest version (5.0.4), please file a support case and/or a bug.

sowings
Splunk Employee
Splunk Employee

Schedule is correct, search is not disabled.

It looks like the REST API is disagreeing with the manager.

0 Karma

hexx
Splunk Employee
Splunk Employee

I would look at the scheduling-specific properties of the saved search object in the REST API.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...