Can scheduled searches be configured to run in sequence?

[andrewtrobec]

Hello All,

Looking for some input. Assumption is that I have two scheduled searches search_1 that writes to summary index summary_1 and search_2 that writes to summary index summary_2. search_2, though, requires the results written to summary_1 and so it should start running only after search_1 has completed.

Is it possible to create a dependency between the two? I see three options:

1. Create a faux dependency through timing, but if search_1 takes longer than the delay before search_2 is scheduled to start, then summary_2 will have incorrect data or will be skipped.
2. Using the realtime_schedule parameter in savedsearches.conf which seems to suggest that if set to 0 for my saved searches then they will be run in sequence of scheduled time, even in the event that a given search completes only after its successor is scheduled to start.
3. Using OS scripting to handle it, but that seems like more pain than what it's worth.

Would like to know what the community thinks.

Thanks!

Andrew

[DMohn]

For your options:

1) This would be a pretty safe way, if the gap between the two searches is long enough.

2) This won't work, as a continuous scheduling (which is what will happen if realtime_schedule is set to 0) will only make the scheduling of the current saved search continuous, but does not care about any other searches scheduled to run.

3) could be painful, depending on the constraints 🙂

If you don't need the searches to run every 5 minutes, and the normal search time is close to these 5 minutes, option 1 would be the safest and most usable method to go for.