Splunk Search

Sequencing Saved Searches

Path Finder

Hi,

I have a saved search, which is currently scheduled, and creates a summary index. I have other saved searches that I want to schedule to run, which will use the summary events, but only after the first has finished, as otherwise, they wouldn't be running against all the records. The first search could take a long time to run, so it is difficult to know when to schedule the others.

Any ideas on the easiest way to achieve this (if there is one) ?

Thanks

Tags (3)
0 Karma

Influencer

Hi,

Not tried this, just (potentially) food for thought...

Can you not control the searches externally from Splunk? - For example, if you have a script scheduled by the OS (e.g. cron on nix, and Scheduler on Windows), and then the script can run the first search and wait for a success before running the second through the CLI.

Ref for CLI saved search running: http://splunk-base.splunk.com/answers/2378/running-a-saved-search-from-the-command-line-interface-cl...

Hope this helps

0 Karma

Path Finder

Thanks for responding. My issue isn't really with kicking off a search, it's knowing when it's safe to do so - i.e. when the last one has finished.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!