Getting Data In

How to assure data arrived from script/web server

nirt
Path Finder

Hi,
I have a scheduled data input script in Splunk which runs every hour, the script is a basic wget from a web server, sometimes that web server is not responding well and causing us to lose data of an hour.
Is there any way to check if data has arrived and if not re-run the script? or any other more efficent way to retreive data from the web server?
the reason why we have this on an hourly cron is that the data only changes once an hour, and I have noticed that when we run it multiple times we get duplicate data in our searches(maybe there is a way to overcome this?)

Thanks in advance

Tags (1)
0 Karma

Ayn
Legend

The best option in my opinion is to build this logic into the script instead.

martin_mueller
SplunkTrust
SplunkTrust

You could run a scheduled search every hour to alert you whenever there is no/not enough data in the previous hour.

0 Karma

nirt
Path Finder

I thought about that but I wanted some more generic/automatic option.. the alert can trigger the script and then it will populate the data - that should work right?
Is there any more basic way to do it? it seems like some workaround

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...