How to refresh cron schedule of a savesearch from cli/api?

[schose]

Hi all,

I have an testapp with a savesearch containing:

[testsearch]
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = 1 * * * 1
dispatch.earliest_time = -7d@d
dispatch.latest_time = -0d@d
display.general.type = statistics
display.page.search.mode = verbose
display.page.search.tab = statistics
enableSched = 1
quantity = 0
relation = greater than
search = | makeresults

when i install the app using gui/api or commandline i see the schedule for next monday 1am. When i now change the schedule and settings to:

[testsearch]
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = 5 * * * *
dispatch.earliest_time = -16m@m
dispatch.latest_time = -1m@m
display.general.type = statistics
display.page.search.mode = verbose
display.page.search.tab = statistics
enableSched = 1
quantity = 0
relation = greater than
search = | makeresults

and checking by

 | rest /servicesNS/-/testsearch/saved/searches | table title cron_schedule eai:acl.app cron_schedule next_scheduled_time | rename eai:acl.app as app | search title=*testsearch

i see that next_scheduled_time is still next monday. running a /debug/refresh or curl -k -u admin:XXX https://localhost:8089/servicesNS/nobody/testsearch/admin/localapps/_reload does not fix the issue. It seems only restarting the searchhead, wait until next schedule (multiple day in this case) or change using the gui fixes the issue. 

In our case non of the above is possible, as we are deploying our apps using a cicd pipeline.

Any hint or workaround?

Best regards,

Andreas

[VatsalJagani]

@schose - Few options, not sure which one you will be able to do.

• Change from UI (SavedSearches, Reports, and Alerts page of Splunk)
  • Will put the configuration in a local folder

• Install the App through CLI
  • This you can even do through your automation.
  • 
• Install App through Splunk REST API
  • https://community.splunk.com/t5/Getting-Data-In/Using-the-REST-API-to-install-an-app-from-a-file/td-....

I hope this helps!! Kindly upvote if it does!!!

[schose]

Hi @VatsalJagani ,

updating the app using REST API or GUI doesn't make a difference. We will open a call for this behaviour.

as a workaround it's possible to "version" your savedsearches -> putting 0001,2,3 at the end. Not very user friendly, but working. 

best regards,

Andreas