we are running 2 steps progress
1. Create lookup (by scheduled report )
2. Create index summary using the lookup data
what will be the best way to make sure the step 2 starts only incase step 1 is completed successfully ?
you can check the triggered report or alert with this search:
index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity"
after you ran this search you can create alert action to run another search to collect the results.
this is just one method but I think you can use a lot of use case.
please use these info to build your search, any search are stored on _audit index.
please add on this search these details to understand if is completed
index=_audit action=search info=completed user=[owner of the search] savedsearch_name=[the name of the search]
please remember to add values on user field and savedsearch_name field
apologize for the multiple answer but without see the data it's little bit hard.
are you identified the saved search on audit log?
also to show your saved search you can use this search
| rest splunk_server=local /services/saved/searches | rename eai:acl.owner AS Author eai:acl.sharing AS Permissions eai:acl.app AS App search AS "Saved Search" | fields Author Permissions App "Saved Search"
let me know