Splunk Enterprise

How to refresh cron schedule of a savesearch from cli/api?

schose
Builder
Hi all,
 
I have an testapp with a savesearch containing:

 

 

[testsearch]
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = 1 * * * 1
dispatch.earliest_time = -7d@d
dispatch.latest_time = -0d@d
display.general.type = statistics
display.page.search.mode = verbose
display.page.search.tab = statistics
enableSched = 1
quantity = 0
relation = greater than
search = | makeresults

 

 

when i install the app using gui/api or commandline i see the schedule for next monday 1am. When i now change the schedule and settings to:

 

 

[testsearch]
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = 5 * * * *
dispatch.earliest_time = -16m@m
dispatch.latest_time = -1m@m
display.general.type = statistics
display.page.search.mode = verbose
display.page.search.tab = statistics
enableSched = 1
quantity = 0
relation = greater than
search = | makeresults

 

 

and checking by

 

 

 | rest /servicesNS/-/testsearch/saved/searches | table title cron_schedule eai:acl.app cron_schedule next_scheduled_time | rename eai:acl.app as app | search title=*testsearch

 

 

i see that next_scheduled_time is still next monday. running a /debug/refresh or curl -k -u admin:XXX https://localhost:8089/servicesNS/nobody/testsearch/admin/localapps/_reload does not fix the issue. It seems only restarting the searchhead, wait until next schedule (multiple day in this case) or change using the gui fixes the issue. 

 

In our case non of the above is possible, as we are deploying our apps using a cicd pipeline.
Any hint or workaround?

 

Best regards,

 

Andreas
Labels (3)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@schose - Few options, not sure which one you will be able to do.

  • Change from UI (SavedSearches, Reports, and Alerts page of Splunk)
    • Will put the configuration in a local folder

 

I hope this helps!! Kindly upvote if it does!!!

0 Karma

schose
Builder

Hi @VatsalJagani ,

updating the app using REST API or GUI doesn't make a difference. We will open a call for this behaviour.

as a workaround it's possible to "version" your savedsearches -> putting 0001,2,3 at the end. Not very user friendly, but working. 

best regards,

Andreas

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...