Reporting

using of year in cron schedule

iKate
Builder

How can one make a cron schedule in Splunk run just in specific year? This can be easily done in 8-digit type of cron schedules but splunk uses just 5 digits.

The case is that I need to backfill summary index only for several months of current year, but our statistics has these months in 2012 and 2011 years so setting schedule like 0 0 * 7-9 * will index data in both years that will be redundant and also will take twice more time and space.

p.s. I can't set earliest time in search or limit time in other way as we need the search to count for all the time.

Tags (3)
0 Karma

reed_kelly
Contributor

I didn't think you can specify retroactive cron schedules. Cron schedules dictate when jobs will run in the future.

Did you look at backfill script ($SPLUNK_HOME/bin/fill_summary_index.py)?

Manage summary index gaps and overlaps

0 Karma

iKate
Builder

Yes, I am using this script. And it's exactly about running and writing to summary index your searches, like they were launched in the past with periodicity set in the (cron)schedule.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...