Can someone suggest a method to ensure my scheduled report will run without being skipped?

[auzark]

Hi,

Can someone suggest to me a method to ensure, my scheduled report will run without being skipped.

Cron = 8,18,28,38,48,58 * * * * with a schedule window of 15 minutes. I use a custom timeframe larger than required to cater for when the report is skipped.

Generally the report will run 2 times an hour sometimes 3, but at times does not run for a full hour. When I run the report adhoc, it takes less than a minute.

[gcusello]

Hi @auzark,

maybe the correct question should be: why are the reports sckipped?

So you should analyze your reports execution,using the Monitoring Console (in the Search section).

You should understand if sometimes there are too jobs planned for the same time, or if the resources aren't sufficient or if you should change your scheduling.

I'd start from these analysis:

• what is your hardware configuration (CPU and RAM)?
• Is the configuration compatible with hardware reference (https://docs.splunk.com/Documentation/Splunk/9.0.0/Capacity/Referencehardware)?
• has your storage the required performaces: at least 800 IOPS, better 1200 (https://docs.splunk.com/Documentation/Splunk/9.0.0/Capacity/Referencehardware#Notes_about_optimizing...)?
• is there a fixed time when Reports are skipped or it's variable,
• how many searches are in execution at the time when a Report is skipped?

Ciao.

Giuseppe

[auzark]

Hi Giuseppe,

Thanks for responding.  Unfortunately, I can not answer all those questions. I work for a large bank in Australia and am deemed a user of Splunk with no access to  our Splunk environment.

I suppose, I was hoping for a magic formula to make sure my report runs on time.

[gcusello · Accepted solution]

Hi @auzark,

I'm sorry I'm not a magitian!

if you could, at least, access the Monitoring Console you could debug your situation, otherwise, you can only report to your manager that there's a problem (Huston, we have a problem!) to analyze, and analysis must be performed starting from my questions.

Good hope, tell me if I can help your more!

Ciao.

Giuseppe