- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Phantom poling data from splunk
ansusabu
Communicator
02-12-2020
03:35 AM
I have a playbook that writes data to an index a. And I am polling events which are closed , ie, `notable
|search status="x"` and data of this event from index 'a' as well. ie, I am using a nested query to get the data. But when I close one of the latest events, that event gets polled immediately, and after that, if I close an event older than that it is not getting polled. Have anyone faced such issue?
