scheduled searches

[simo]

Hi all,

I have two scheduled searches, is there the possibility to launch the second one at the end of the first?

can you help me? thanks for any answer

Best Regards,

Simone

[hoaxm3]

Maybe check this answer out: https://community.splunk.com/t5/Splunk-Search/Can-one-search-trigger-another/m-p/250116

[isoutamo]

Hi

Unfortunately there haven't been any official way to do it. If I recall right in https://ideas.splunk.com is request for this.

Anyhow you could try e.g. add the result of first schedule to kvstore / lookup and then in the beginning of the second schedule check it and run only if it is what you are expecting.

r. Ismo

[simo]

Hi,

my first search writes to an index using | collect index =

the second one from the index and produces a file | outputcsv mycsv

I'm trying to get them to run sequentially through cmd, it's possible?

Simone