Reporting

Is there a way to "trigger" another search when previous saved search finished?

leo_systex
Explorer

Is there a way to "trigger" another search when previous saved search finished?

I have a complicated jobs to run on splunk, so I separate it as two part :
One will generate a temporary lookup table , and the second one will use it.

Usually I configure them as two schedule search , and there is a buffer-time between them.
But the buffer-time is hard to decide, it depend on log volume and system performance at the execution time.
Sometime the second search run but the first search is not finish.
Sometime the first search run and rewrite the lookup table, but the previous second search is still running....
It cause wrong result for my report, and hard to trouble-shooting~

So I want to know if there any way to "trigger" another search when previous saved search finished?
So I could combined them as only one schedule job.

Or any idea to control the workflow on splunk?

0 Karma

ssadh_splunk
Splunk Employee
Splunk Employee
0 Karma

ravicheepa
Engager

Did you try doing same thing using Subsearchs concept.
http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Aboutsubsearches

Let me know if works for you.

0 Karma

leo_systex
Explorer

Yes, I know the concept of subsearch. But there are some many limitation on subsearch ( Ex: number of return records. ) , I am processing a huge number of data, and the scenarios is not suit for subsearch.

0 Karma

deepashri_123
Motivator

Hey@leo_systex,

You can use something such as load job and run your search based on the result of load job.
Refer this link:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Loadjob

Let me know if this helps!!

0 Karma

leo_systex
Explorer

What I wanted is when the first search job done, "trigger" the second search job to run... How could I implement this idea by "loadjob" ?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.