Splunk Search

scheduled update of a lookup file.

daktapaal
Path Finder

Dear Splunkers.
I have a form, where I am loading a drop down, using a lookup file, that searches the top products. I am using.


><![CDATA[|inputlookup top-products.csv]]>

The top-products.csv is a result of outputting the search results of the top products. <!--
index = "ssh" | dedup product | table product | outputlookup products-table.csv
called as Search-Product-->

I then use one of the products selected in the drop down for creating a search string. All works fine. I now need to make sure I always get the correct and updated set of products in the drop down. This probably requires me to run the search " Search-Product" above, regularly like every day, so that I can get the updated results every day..

Is there a way to schedule a search like :
index = "ssh" | dedup product | table product | outputlookup products-table.csv

on a daily basis or hourly basis?

Dak

Tags (3)
0 Karma
1 Solution

aholzer
Motivator

Yes. Save your search. Go to Manager > saved searches > edit the saved search related to this. Click the check box labeled "schedule this search", and it'll expand all the options you have available for scheduling a search to run automatically.

Hope this helps.

View solution in original post

aholzer
Motivator

Yes. Save your search. Go to Manager > saved searches > edit the saved search related to this. Click the check box labeled "schedule this search", and it'll expand all the options you have available for scheduling a search to run automatically.

Hope this helps.

Ayn
Legend

Converted your answering comment to a proper answer, again.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...