Reporting

using of year in cron schedule

iKate
Builder

How can one make a cron schedule in Splunk run just in specific year? This can be easily done in 8-digit type of cron schedules but splunk uses just 5 digits.

The case is that I need to backfill summary index only for several months of current year, but our statistics has these months in 2012 and 2011 years so setting schedule like 0 0 * 7-9 * will index data in both years that will be redundant and also will take twice more time and space.

p.s. I can't set earliest time in search or limit time in other way as we need the search to count for all the time.

Tags (3)
0 Karma

reed_kelly
Contributor

I didn't think you can specify retroactive cron schedules. Cron schedules dictate when jobs will run in the future.

Did you look at backfill script ($SPLUNK_HOME/bin/fill_summary_index.py)?

Manage summary index gaps and overlaps

0 Karma

iKate
Builder

Yes, I am using this script. And it's exactly about running and writing to summary index your searches, like they were launched in the past with periodicity set in the (cron)schedule.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...