Splunk Search

Run searchname returned from a scheduled query as a new search

Mag2sub
Path Finder

We have a a scheduled query that returns certain search names ...how do we automate such that the scheduled query that returns certain search names automatically runs those searches again ?
Appreciate inputs!

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Say your search returns a row per to-be-run saved search names in the field search, then you can run those using map:

your scheduled search returning a field search per row | map search="savedsearch $search$"
0 Karma

Mag2sub
Path Finder

Can we use the backfill summary index script without summary action and modify for alerts ?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In that case time ranges and alert actions matter a lot as well - that complicates things a lot, I don't think there's a reasonable fully automatic one-search solution to that.

0 Karma

Mag2sub
Path Finder

Alerting searches

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What are those saved searches doing? Summary Indexing? Alerting? Reporting? ...?

0 Karma

Mag2sub
Path Finder

Now the scheduled search is returning some scheduled distributed search names which had at that schedule time lost connection with peer...when we use map wont it run the same search using a system time for schedule ...while we wanted the time the connectivity was lost as the schedule time ...how can we do the same ?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...