Splunk Search

How to run a search query with a scheduler (crontab)

YungLee
Engager

I would like to run a search query every few min, how can i do that.

E.g. index = "a" sourcetype = "b"

Any help is appreciated.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set the schedule to something like this (for every 5 minutes, of every hour of every day etc.)

*/5 * * * *
0 Karma
Get Updates on the Splunk Community!

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...