Reporting

How to run a report and write results only once in a scheduled time window ?

vinaybandaru
Path Finder

Hi All,

I have a report that should run for example between the time period 8.00 pm to 10.00 pm with a frequency of every 5 min from monday to friday.
The report is a join of two indexes and the report gives results from first index when there are records indexed in second index that is linked to a batch job completion in unix server and this job is uncertain when it will finish but generally finishes between 8 pm and 10 pm. So for example on monday the job is finished at 8.27 pm and our report starts executing from 8.00 pm :
8.00 - ko;
8.05 - ko;
8.10 - ko;
8.15 - ko;
8.20 - ko;
8.25 - ko;
8.30 - ok; so it should stop executing the next runs on that day.

Similarly other days in the same way. Could you please help me if you have know how to achieve this ?

Many thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not have the report run once at 10pm?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vinaybandaru
Path Finder

That was just an example. In my scenario i don't have the fixed time. sometimes the job is finished on the same day. sometimes on the next day morning. So I don't have particular time to define and don't want to wait untill the fixed time for all days if the job is finished early.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...