How to get searches to run automatically after a lookup is updated instead of manually scheduling reports?

[DanielFordWA]

Hi,

I have around 50-60 searches/reports that are required to run each month after a lookup is manually updated and uploaded to Splunk.

The time of the lookup update can occur between 2-7 days after the start of the next month.

I have all the queries saved as reports I could schedule.

Is there a way in Splunk to get these reports to run automatically one after another as soon as the lookup is updated, or even better, be able to set off the entire run at any time I choose?

I want to stop having to manully sechdule 50-60 reports each month as I dont know when the lookup will be updated.

Thanks,

Dan

[Richfez · Accepted solution]

I'm not sure about your exact use case, but generally you can run stuff from the CLI so perhaps some fiddling around with this may get you what you need, if no one comes up with a better idea?

CLI Search Syntax