How do I create a report that can run automatically only when the indexer performs indexing after receiving an input file from forwarder instead of the scheduling with given fixed time ?

[vinaybandaru]

How do I create a report that can run automatically only when the indexer performs indexing after receiving an input file from forwarder instead of the scheduling with given fixed time ?

I have a requirement to create a report to consider the actual volumes which acquires data from an indexed file that is received forwarded by the forwarder (not frequently) but when received and indexed the input file the report should automatically run with out depending on the scheduler. May be for example if the file has to be generally received daily once but if the file has not arrived but it arrived in delay (no fixed delay) or arrived next day how can i manage this kind of requirement in splunk ?

Could you please help me ?

[woodcock · Accepted solution]

You can schedule a search like this with a very wide value for Time picker:

index=<You should always specify an index> AND sourcetype=<And sourcetype too> AND source=<Your File Name here> _index_earliest=-5m@m ...

This way, even if the _time values are weeks old, the time it was indexed is in the last 5 minutes and you can do your work based on that.

[gcusello]

Hi vinaybandaru,
create an alert that check if there are data in a period (e.g. one hour): if there are data, alert sends a report with the found data to an eMail, if there aren't results, alert isn't triggered and it not doesn't send anything.
Bye.
Giuseppe