Sequencing Saved Searches

[JovanMilosevic]

Hi,

I have a saved search, which is currently scheduled, and creates a summary index. I have other saved searches that I want to schedule to run, which will use the summary events, but only after the first has finished, as otherwise, they wouldn't be running against all the records. The first search could take a long time to run, so it is difficult to know when to schedule the others.

Any ideas on the easiest way to achieve this (if there is one) ?

Thanks

[MHibbin]

Hi,

Not tried this, just (potentially) food for thought...

Can you not control the searches externally from Splunk? - For example, if you have a script scheduled by the OS (e.g. cron on nix, and Scheduler on Windows), and then the script can run the first search and wait for a success before running the second through the CLI.

Ref for CLI saved search running: http://splunk-base.splunk.com/answers/2378/running-a-saved-search-from-the-command-line-interface-cl...

Hope this helps

[JovanMilosevic]

Thanks for responding. My issue isn't really with kicking off a search, it's knowing when it's safe to do so - i.e. when the last one has finished.