Reporting

scheduled search doesn't get any events

sansri7680
Path Finder

Hi

I created a scheduled search with the below search string

sourcetype="MME_Reject-3" | eval indextime=_indextime | eval tnow=now() | eval diff=tnow-indextime | sort + diff | where diff<60 | reverse | table _raw | outputcsv 4G_REJECT_LOG.txt

The source is fed by a forwarder that forwards data from windows machine

The search brings results whenever it is force run but when it runs using the schedule of 1 minute it doesn't bring any result

Can someone throw light on what the problem could be. splunkd.log doesn't display any error

0 Karma
1 Solution

sansri7680
Path Finder

Found it out. The dispatch.ttl was the culprit. I changed it to 1 second and everything is fine now

View solution in original post

sansri7680
Path Finder

Found it out. The dispatch.ttl was the culprit. I changed it to 1 second and everything is fine now

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...