Reporting
Highlighted

using of year in cron schedule

Builder

How can one make a cron schedule in Splunk run just in specific year? This can be easily done in 8-digit type of cron schedules but splunk uses just 5 digits.

The case is that I need to backfill summary index only for several months of current year, but our statistics has these months in 2012 and 2011 years so setting schedule like 0 0 * 7-9 * will index data in both years that will be redundant and also will take twice more time and space.

p.s. I can't set earliest time in search or limit time in other way as we need the search to count for all the time.

Tags (3)
0 Karma
Highlighted

Re: using of year in cron schedule

Contributor

I didn't think you can specify retroactive cron schedules. Cron schedules dictate when jobs will run in the future.

Did you look at backfill script ($SPLUNKHOME/bin/fillsummary_index.py)?

Manage summary index gaps and overlaps

0 Karma
Highlighted

Re: using of year in cron schedule

Builder

Yes, I am using this script. And it's exactly about running and writing to summary index your searches, like they were launched in the past with periodicity set in the (cron)schedule.

0 Karma