Savedsearch - alternative to CRON job?

[GregSmith]

I have a savedsearch running on a 5 minute cron schedule iteratively working through a list of previously saved search parameters.

2 Things

(1) Can I have a conditional CRON schedule such that I somehow detect when work needs to be performed and if so, enable the CRON? The processing for a day may take 6 hours, but the CRON keeps running and burning resources.

(2) Some of the savedsearches run in < 1 min but others take longer than 5 minutes. Instead of using a CRON schedule, can I detect the savedsearch ID, detect when it has completed and then initiate the subsequent execution of the savedsearch on the next batch of data?  

[richgalloway · Accepted solution]

1) Cron runs continuously.  There's no way to change that.  Checking whether it's time to run a cron job is likely to be far less resource-intensive than checking if work needs to be performed.

2) You may be able to use the Splunk SDK/API to detect when a search completes and then trigger a subsequent search.

[GregSmith]

Thank you Rich. Good pointers. When I come up for air, I will pursue the SDK/API path.