Reporting

Is it possible to use a scheduled search within a dataset?

spammenot66
Contributor

I like splunk's pivot table capabilities and am wondering if its possible to use a scheduled search within a dataset. You may ask, why not drop in the full query from the scheduled search into the datamodel then accelerate it. I've had issues with the accelerated data model consuming too much resource in the past and am trying to avoid it by using scheduled search to ensure it runs specific time at specific intervals. In going this route, I am missing out on the pivot UI

0 Karma

woodcock
Esteemed Legend

A dataset can be a simple lookup file so all you need to do is setup a scheduled search and use | outputlookup or the built-in alerting function to save results to a lookup file. Put in whatever schedule suits you and update the lookup file that you have also setup as a dataset.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Hmmm. Is your scheduled search producing a reasonably small output, relative to the data being searched?

If so, then consider using your scheduled search to load a summary index, then basing your datamodel on the summary index data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...