Splunk Search

Can we pause a scheduled search for 30 seconds??

Srubhi
Path Finder

I need to know how we can pause the search for 30 seconds and then run the saved search 
for example, i have a search scheduled at 9:30:00 my requirement is that the search should pause for 30 seconds and run at 9:30:30 seconds. 

It would be more helpful if anyone help me in resolving this!!

happy Splunking!!

Labels (1)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. There is no "pause" command.

Also please remember that just because the schedule says "9:30:00", it does not mean that the search will be run at that particular point in time. Scheduling and spawning the search usually takes some time even on a lightly-loaded infrastructure. And if you have delayed/skipped searches - don't even get me started 😉

There is also a question of what time you understand as "starting the search" - dispatching the search to a SHC member? Initializing the search on that member? Pushing the search request to the indexers?

So don't rely on the "start search" time. If you want your search to return results from a particular time range, specify it in the time specifier (oh boy, this sounds bad :-)) and adjust your search schedule accordingly.

In other words, if you want your search to always return data from X:30:30 to X+1:30:30, schedule your search to - for example

35 * * * *

and set

earliest=-1h@h+30m+30s latest=@h+30m+30s
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...