Reporting

using of year in cron schedule

iKate
Builder

How can one make a cron schedule in Splunk run just in specific year? This can be easily done in 8-digit type of cron schedules but splunk uses just 5 digits.

The case is that I need to backfill summary index only for several months of current year, but our statistics has these months in 2012 and 2011 years so setting schedule like 0 0 * 7-9 * will index data in both years that will be redundant and also will take twice more time and space.

p.s. I can't set earliest time in search or limit time in other way as we need the search to count for all the time.

Tags (3)
0 Karma

reed_kelly
Contributor

I didn't think you can specify retroactive cron schedules. Cron schedules dictate when jobs will run in the future.

Did you look at backfill script ($SPLUNK_HOME/bin/fill_summary_index.py)?

Manage summary index gaps and overlaps

0 Karma

iKate
Builder

Yes, I am using this script. And it's exactly about running and writing to summary index your searches, like they were launched in the past with periodicity set in the (cron)schedule.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...