How scheduling works?

[lukasz92]

Hi,

I have a scheduled search that runs every 1 minute and it searches events on last 1 minute.

Will this search cover all future events?
If the search could start (for example) at 5:07:05 and than at 5:08:07 - are the data from (5:07:05 - 5:07:07) lost?

[horsefez · Accepted solution]

Hi lukasz92,

there is a solution to your problem.

Try to apply the following settings to your alert

This will asure, that everything from 02:46:00 to 02:47:00 is covered. The alert is able to run between 02:47:00 and 02:47:59 and will still catch the data.

---

BUT, splunk takes time to index data... so data that reaches the machine on 02:46:59 might not be indexed by 02:47:00... so you should try to make like a little "window" for your alert to run in... do that in the Cron-Expression field.

[lukasz92]

it is a great solution. I have not thought about "@m".
Thanks!

[horsefez]

Glad to help! 🙂

[skoelpin]

What are you trying to accomplish with your scheduled search? Do you have an alert tied to this scheduled search?

You set the time window for 1 minute, so technically the data is not "lost", but the data is not available in your 1 minute window if it's older than 1 minute

[lukasz92]

Yes, Something like searching for custom events and alerting.

Technically I agree and understand - my question was about practice: how this does actually work.