Splunk Search
Highlighted

How do I set a query to run overnight without it expiring before it completes?

Builder

I need to run a search that will take around 6-8 hours. Just a lot of URLs with wildcards to look for in a terabyte of access logs with two indexers.

It seems as though if I go AFK for over 30 minutes then the search freezes or the job expires when it was still searching. How do I prevent this so that I can let it run overnight?

Edit: For now I shared the job from the Job Manager and I think it extended its life for 7 days. Hopefully this does it...

0 Karma
Highlighted

Re: How do I set a query to run overnight without it expiring before it completes?

SplunkTrust
SplunkTrust

Hey you can send the job to background
Have a look at this doc!
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Aboutjobsandjobmanagement#Job_menu

Once you do this you will get a link which you can access for 7 days

Let me know if this helps !

Highlighted

Re: How do I set a query to run overnight without it expiring before it completes?

Builder

Hmm I don't see that option anywhere. I shared the search instead and I think that did it.

0 Karma
Highlighted

Re: How do I set a query to run overnight without it expiring before it completes?

SplunkTrust
SplunkTrust

After entering your query on the right side of the search bar below time picker you will see Job v click on that and you will see Send Job to Background option.

0 Karma
Highlighted

Re: How do I set a query to run overnight without it expiring before it completes?

SplunkTrust
SplunkTrust

Is this ad-hoc search or scheduled search? If it is scheduled search then what is the running frequency ? Worth to look at https://docs.splunk.com/Documentation/Splunk/7.0.1/Search/Extendjoblifetimes

0 Karma