Splunk Dev

Cron job condition when running DBX query

k_harini
Communicator

Hi,
I have a condition where we have to run dbxquery command based on scheduling condition.. Only on Mondays between 8 am to 2 pm.. Incase if Monday is public holiday it should run on Tuesday.. How can we achieve this?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Run the Monday one with a regular cron then every year go through and figure out when the holiday things are and setup INDIVIDUAL jobs for each Tuesday, writing the queries in such a way that the Tuesday run always overwrites the previous day's run.

0 Karma

k_harini
Communicator

How to make Tuesday run overwrite? Here we have used saved search with dbxquery and summary indexed the data.. I can have a look up list of public holidays. With tat how can I change cron job?

0 Karma

woodcock
Esteemed Legend

Keep the same search that should end in | collectand add to it something like this:

| search ThisFieldDoesNotExist="So this will throw away all the events we just saved"
| append [ search [|makeresults | eval search = "earliest=-1d@d latest=0d@d-1" | table search] index="YourSummaryIndexHere"
|delete ]
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...