Archive

How scheduling works?

lukasz92
Communicator

Hi,

I have a scheduled search that runs every 1 minute and it searches events on last 1 minute.

Will this search cover all future events?
If the search could start (for example) at 5:07:05 and than at 5:08:07 - are the data from (5:07:05 - 5:07:07) lost?

1 Solution

horsefez
SplunkTrust
SplunkTrust

Hi lukasz92,

there is a solution to your problem.

Try to apply the following settings to your alert

alt text

This will asure, that everything from 02:46:00 to 02:47:00 is covered. The alert is able to run between 02:47:00 and 02:47:59 and will still catch the data.


BUT, splunk takes time to index data... so data that reaches the machine on 02:46:59 might not be indexed by 02:47:00... so you should try to make like a little "window" for your alert to run in... do that in the Cron-Expression field.

View solution in original post

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi lukasz92,

there is a solution to your problem.

Try to apply the following settings to your alert

alt text

This will asure, that everything from 02:46:00 to 02:47:00 is covered. The alert is able to run between 02:47:00 and 02:47:59 and will still catch the data.


BUT, splunk takes time to index data... so data that reaches the machine on 02:46:59 might not be indexed by 02:47:00... so you should try to make like a little "window" for your alert to run in... do that in the Cron-Expression field.

View solution in original post

0 Karma

lukasz92
Communicator

it is a great solution. I have not thought about "@m".
Thanks!

0 Karma

horsefez
SplunkTrust
SplunkTrust

Glad to help! 🙂

0 Karma

skoelpin
SplunkTrust
SplunkTrust

What are you trying to accomplish with your scheduled search? Do you have an alert tied to this scheduled search?

You set the time window for 1 minute, so technically the data is not "lost", but the data is not available in your 1 minute window if it's older than 1 minute

0 Karma

lukasz92
Communicator

Yes, Something like searching for custom events and alerting.

Technically I agree and understand - my question was about practice: how this does actually work.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!