Incremental saved report

[eranday]

Turning to the wisdom of the Splunkers,

I have an event called "station status" that basically sends on a daily basis operational info about my stations.

I would like to build a saved report (or any other solution) that holds the most updated event for each station and looking for suggestions on how to approach this.

Please consider:
1. The report can be updated between 3 to 6 times a day
2. I don't want to hold old events from a station. Meaning, if new info arrives regarding a station, it should delete or update the old data.

Thanks in advance,
Eran

[CarsonZa · Accepted solution]

if im understanding correctly you could run a scheduled report that overwrites a lookup with the current status. Then you have second report/dashboard that calls that lookup file, thus the oldest data would be the time in between your scheduled searches.

so have scheduled report that runs every 15 minutes or so. That outputs the status of each station like so.

station1, up
station2, down
station3, up

because you are overwriting the lookup on each run the status will always be current and you wont have to manipulate any of the data.

[eranday]

Thank you @CarsonZa for your detail answer.
I've might have missed an important fact.
We might not receive status from some stations for days (the station is shut down or lack of internet connection).

The reason I'm pointing this now is, that from your solution, I understand that my scheduled report will need to run over all time (in order to catch stations that stopped reporting).

Does this make sense? Am I missing something?
Thanks again, your effort is most appreciated.

Eran

[CarsonZa]

it doesn't have to run over all time. you would just have to build in some logic to your search. My personal opinion is if the search doesn't return any results for a particular station then that station is down (whether it actually is or not). so you have to have some if statements in your search to add the entry to your lookup. which is what @skoelpin was referring to

[eranday]

thank you @CarsonZa & @skoelpin!!
this was very helpful.

[skoelpin]

Feel free to upvote if this helped

[skoelpin]

This is the way to go. The only thing to consider is when the data is null and the | outputlookup overwrites the existing table with a null result which will cause the lookup table to be null. Easy fix with a pre-processing step

[jplumsdaine22]

That should be fairly straightforward. What have you already tried? The parts you're getting stuck on will be greatly illuminating as the answers to your questions are going to be "it depends" without more information on the structure of your events and how frequently they come in.