Reporting

Problem with scheduled reports

wsadowy1
Explorer

I have several reports scheduled to run at the same time with a window set to 5 minutes.
When the time they were scheduled to passes and I type the following command into the search window to check the status of these reports, it turns out almost none of them did run:

index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") |search sched="2016-09-23 10:15:00"| table sched status savedsearch_name

I also see sos_refresh_splunk_servers_cache under savedsearch_name a lot of times.
What is it, and how can I make these reports run as scheduled?
Thank you

0 Karma

inventsekar
SplunkTrust
SplunkTrust

on inputs.conf, what info you have for [search] stanza.

can you run this for last 24hrs (or last 7 days) and check how many active_hist_searches and active_realtime_searches are there..

 index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | table active_hist_searches active_realtime_searches
0 Karma

wsadowy1
Explorer

I'm using Web Splunk and I don't know how to open the inputs.conf file unfortunately.
As for the search you provieded. I ran it for the past 7 days and got over 190k rows of results. Would you like me to give you the sums of active_hists and active_realtime fields?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...