Reporting

Reports say first scheduled run not completed, but it has run many times on schedule

decoherence
Explorer

I have a scheduled report that sends an email which includes

  • a link to the report
  • a link to the results, and
  • the CSV

The link to the results and the attached CSV are fine and have the expected data. However, when a user clicks the link to the report, the report says "There are no results because the first scheduled run of the report has not completed."

Why might this be? Is it related to the job lifespan? This report runs monthly and I'd like the results to be available until the next run.

Thank you for any insight. I'm using 7.2.0.

0 Karma
1 Solution

decoherence
Explorer

I seem to have found a solution. From this page: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf:

  • If an action is triggered, the ttl is changed to the ttl for the action. If multiple actions are triggered, the action with the largest ttl is applied to the artifacts. To set the ttl for an action, refer to the alert_actions.conf.spec file.

As I mentioned, these reports have a 'send email' action. This lead me to go to Settings > Searches, reports and alarms > Find the report in the list > Edit > Advanced Edit, finding the ttl for the 'Send email' action (action.email.ttl) and adjusting it to what I want. Now when the report runs, the search's expiry is what it should be.

I'm surprised I didn't find someone else doing this, as it must be a common issue. It would be great if someone could confirm for me whether this is standard operating procedure for Splunk 7.2.

View solution in original post

decoherence
Explorer

I seem to have found a solution. From this page: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf:

  • If an action is triggered, the ttl is changed to the ttl for the action. If multiple actions are triggered, the action with the largest ttl is applied to the artifacts. To set the ttl for an action, refer to the alert_actions.conf.spec file.

As I mentioned, these reports have a 'send email' action. This lead me to go to Settings > Searches, reports and alarms > Find the report in the list > Edit > Advanced Edit, finding the ttl for the 'Send email' action (action.email.ttl) and adjusting it to what I want. Now when the report runs, the search's expiry is what it should be.

I'm surprised I didn't find someone else doing this, as it must be a common issue. It would be great if someone could confirm for me whether this is standard operating procedure for Splunk 7.2.

decoherence
Explorer

https://docs.splunk.com/Documentation/Splunk/7.2.0/Search/Extendjoblifetimes

On this page it says

Default lifetimes for scheduled searches

Scheduled searches launch search jobs on a regular interval. By default, these jobs are retained for the interval of the scheduled search multiplied by two. For example, if the search runs every 6 hours, the resulting jobs expire in 12 hours.

This seems to imply there is something strange going on with my setup. I have a weekly scheduled report that completed at Jan 13, 2020 3:00:14 AM but the expiry for the job is Jan 15, 2020 9:16:00 AM. That's 54 hours. Where did THAT value come from? Should it not be two weeks, according to the above?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...