Reporting

How to reschedule a saved search to run at a future time if the latest data is not present?

kamal_jagga
Contributor

Hi,

I have a saved search scheduled which runs every morning, but sometimes the data is not available. So...
1. I want to first search/detect whether latest data is there or not.
2. If not, schedule the search for 12 hours later.
3. If Yes, then run the search.

Basically, I want to reschedule the search by 12 hours, if the required data for that search has not been ingested in Splunk.

Kindly advise.

0 Karma
1 Solution

kamal_jagga
Contributor

i thought of a solution.
1. Run alert for data found.
2. If Yes,Run the shell script in alert . using shell script.
Run the saved search using curl command.
3. If No, Go to step 1

View solution in original post

0 Karma

kamal_jagga
Contributor

i thought of a solution.
1. Run alert for data found.
2. If Yes,Run the shell script in alert . using shell script.
Run the saved search using curl command.
3. If No, Go to step 1

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...