- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a savedsearch running on a 5 minute cron schedule iteratively working through a list of previously saved search parameters.
2 Things
(1) Can I have a conditional CRON schedule such that I somehow detect when work needs to be performed and if so, enable the CRON? The processing for a day may take 6 hours, but the CRON keeps running and burning resources.
(2) Some of the savedsearches run in < 1 min but others take longer than 5 minutes. Instead of using a CRON schedule, can I detect the savedsearch ID, detect when it has completed and then initiate the subsequent execution of the savedsearch on the next batch of data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
1) Cron runs continuously. There's no way to change that. Checking whether it's time to run a cron job is likely to be far less resource-intensive than checking if work needs to be performed.
2) You may be able to use the Splunk SDK/API to detect when a search completes and then trigger a subsequent search.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
1) Cron runs continuously. There's no way to change that. Checking whether it's time to run a cron job is likely to be far less resource-intensive than checking if work needs to be performed.
2) You may be able to use the Splunk SDK/API to detect when a search completes and then trigger a subsequent search.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Rich. Good pointers. When I come up for air, I will pursue the SDK/API path.
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)