Reporting

Problem with scheduled reports

wsadowy1
Explorer

I have several reports scheduled to run at the same time with a window set to 5 minutes.
When the time they were scheduled to passes and I type the following command into the search window to check the status of these reports, it turns out almost none of them did run:

index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") |search sched="2016-09-23 10:15:00"| table sched status savedsearch_name

I also see sos_refresh_splunk_servers_cache under savedsearch_name a lot of times.
What is it, and how can I make these reports run as scheduled?
Thank you

0 Karma

inventsekar
SplunkTrust
SplunkTrust

on inputs.conf, what info you have for [search] stanza.

can you run this for last 24hrs (or last 7 days) and check how many active_hist_searches and active_realtime_searches are there..

 index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | table active_hist_searches active_realtime_searches
0 Karma

wsadowy1
Explorer

I'm using Web Splunk and I don't know how to open the inputs.conf file unfortunately.
As for the search you provieded. I ran it for the past 7 days and got over 190k rows of results. Would you like me to give you the sums of active_hists and active_realtime fields?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...