Reporting

How to reschedule a saved search to run at a future time if the latest data is not present?

kamal_jagga
Contributor

Hi,

I have a saved search scheduled which runs every morning, but sometimes the data is not available. So...
1. I want to first search/detect whether latest data is there or not.
2. If not, schedule the search for 12 hours later.
3. If Yes, then run the search.

Basically, I want to reschedule the search by 12 hours, if the required data for that search has not been ingested in Splunk.

Kindly advise.

0 Karma
1 Solution

kamal_jagga
Contributor

i thought of a solution.
1. Run alert for data found.
2. If Yes,Run the shell script in alert . using shell script.
Run the saved search using curl command.
3. If No, Go to step 1

View solution in original post

0 Karma

kamal_jagga
Contributor

i thought of a solution.
1. Run alert for data found.
2. If Yes,Run the shell script in alert . using shell script.
Run the saved search using curl command.
3. If No, Go to step 1

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...