cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
alicepessani
Explorer
Member since: ‎10-25-2018
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 5
Member Since ‎10-25-2018
Activity Feed
View All

Re: How do you delay a report execution to avoid m...

by in Reporting
‎11-05-2018 09:02 AM
‎11-05-2018 09:02 AM
Hi @darrenfuller , thanks for your reply, but I have already discard this solution for the following reason: in this way, if I set the report with cron schedule 1,31,,,* , but then if my report will run at 20:03 for example due to the fact that other report are running in parallel and are absorbing resources my time window of search will not be from 19:30 to 20 but from 19:32 to 20:02 ( please consider that we would like to leave the choice of the window in which start the Scheduled Report to Splunk Scheduler in order to avoid skipped Searches and this is just the first of a series of report that will be scheduled) Could you kindly suggest me a way to obtain my requirement? Regards, Alice ... View more

How do you delay a report execution to avoid missi...

by in Reporting
‎10-31-2018 11:39 AM
2 Karma
‎10-31-2018 11:39 AM
2 Karma
Hello, I'm trying to launch a report through the Search and Reporting app, but I need to insert a delay in the report execution in order to avoid missing data due to an indexing delays. As by now, my report is scheduled as following: I want to launch the report every day every half an hour, so I set Cron Expression-->0,30 star star star star I want to launch the report for the last 30 minutes, so I set through Select Time Range --> Earliest 30 minutes ago (with Beginning of minute flagged) and Latest with Beginning of current second set Example --> I want to run the report at 8 PM and consider a search window of last 30 minutes from 7:30 PM to 8:00 PM (the same at 8:30 PM, 9:00 PM 9:30 PM,....) But, in this way, I am not counting all data/events due to an indexing delay. For this reason, I need to find a solution that: Allows me to insert a delay in report execution --> e.g 1 minute delay (so if in the before example the report was scheduled at 8 PM I want to execute it at 8:01 PM) Allows me to set the search window always as the last 30 minutes of the current half an hour (e.g. in my example if I execute the report at 8:01 PM my search window should be always from 7:30 PM to 8:00 PM; furthermore I want to set the earliest of the window with "Beginning of minute" and Latest with "Beginning of current second". Is there a way to satisfy my requirement? I know that in ITSI there is the possibility to add a "Lag" to perform a search with a delay in reference to the time window of the base/ad hoc search of a Service. Is there the same functionality also in Search and reporting App? Thanks for a feedback. Alice ... View more

Re: Scheduled report not showing zero lines

by in Reporting
‎10-31-2018 10:55 AM
1 Karma
‎10-31-2018 10:55 AM
1 Karma
Hello, thanks for your feedback! Your method is working fine, but in order to have in output also other values from mylookup.csv I have added a lookup command in my final solution (see below). My final solution is the following: | inputlookup mylookup.csv | join _time [search index="my_index" sourcetype="my_sourcetype" my query | fields | timechart span=30min count as "my_value1" ] | my calculation | appendpipe [| stats count | where count==0 | addinfo | eval _time = round (info_min_time,0)| eval"my_value1" = count | lookup "mylookup.csv " _time OUTPUT _time .... fields ... | my calculation] | table _time, ...fields... | eval index_id = "my_id" | eval env="my_env" | eval ... | fields | collect index=test ... View more

Scheduled report not showing zero lines

by in Reporting
‎10-25-2018 03:13 AM
2 Karma
‎10-25-2018 03:13 AM
2 Karma
Hello, I have scheduled a report that not show output lines if their value is zero. I try to explain you, I have scheduled a report like this: | inputlookup mylookup.csv | join _time [search index="my_index" sourcetype="my_sourcetype" my query | fields ** | timechart span=30min count as "my_value1" ] | my calculation | table my_value1, my_value2, my_value3,..... | eval index_id = "my_id" | eval env="my_env" | eval ... | fields * | collect index=test The report is scheduled every half an hour and takes the data of "last 30 minutes" and put them into an index "index=test". The problem is that when the my_value1 has zero value ("0") the report doesn't put any line in output index. I have noticed also that if I schedule or launch manually the same report by taking more then "last 30 mintues", for example last 2 hours the report write in the output index "index=test" also the "0" line/s (with my_value1=0), ONLY if the other lines (in my example other 3 lines) have a my_value1 different from "0". Example (last 30 min) output: "No results found. Try expanding the time range." Example (last 2 hour) output: line 1. _time , 0 line 2. _time, 22 line 3. _time 3 line 4. _time 4 Could you kindly suggest me how to have a line in the output index when my_value1 has zero value? I anticipate you that I can't perform a left join (join type=left) because my lookup contains also other _time values (greater than the actual) that I don't want to show in my index as results (I just want to take the data in the look up table that has the same actual _time). Thanks for a feedback. Alice ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from