I would like to build a summary index (runs hourly) of the following: sourcetype=http_access | transaction SESSION_ID maxspan=1800s maxpause=120s | sistats count The summary index works fine but I am worried the same session is counted twice if the session more than one summary interval. Lets say user X starts a session at 13:59. The user makes a requests at 13:59, 14:00, 14:01 The session is counted once for the 13th hour but then it's counted again for the 14th hour. Is there a way to exclude sessions that were started in the previous interval? I think what I want is to run the summary query every 30min looking at the previous hour. However I want to exclude transactions where the transaction start time is greater than 30min ago. ... View more

I defined a scripted input: [script://$SPLUNK_HOME/etc/apps/ccbn/bin/get_domain_by_date] disabled = true host = dbserver index = main interval = 0 1 * * * #frequency to run the script source = newman_db sourcetype = feedback_by_domain When I run the script I get output like this: 20110830: date=20110830,domain=aim.com,type=2,count=12 20110830: date=20110830,domain=aol.com,type=2,count=88 20110830: date=20110830,domain=aol.com,type=3,count=68 20110830: date=20110830,domain=att.net,type=2,count=35 20110830: date=20110830,domain=bellsouth.net,type=2,count=15 20110830: date=20110830,domain=bls.gov,type=2,count=11 20110830: date=20110830,domain=comcast.net,type=2,count=74 20110830: date=20110830,domain=comcast.net,type=3,count=27 20110830: date=20110830,domain=gmail.com,type=2,count=31 20110830: date=20110830,domain=hotmail.com,type=2,count=439 20110830: date=20110830,domain=hotmail.com,type=3,count=164 20110830: date=20110830,domain=irs.gov,type=1,count=14 20110830: date=20110830,domain=live.com,type=2,count=77 20110830: date=20110830,domain=live.com,type=3,count=12 20110830: date=20110830,domain=msn.com,type=2,count=13 20110830: date=20110830,domain=msn.com,type=3,count=17 20110830: date=20110830,domain=optonline.net,type=2,count=11 20110830: date=20110830,domain=sbcglobal.net,type=2,count=32 20110830: date=20110830,domain=sbcglobal.net,type=3,count=15 20110830: date=20110830,domain=verizon.net,type=2,count=47 20110830: date=20110830,domain=yahoo.ca,type=3,count=54 20110830: date=20110830,domain=yahoo.com,type=2,count=642 20110830: date=20110830,domain=yahoo.com,type=3,count=310 20110830: date=20110830,domain=ymail.com,type=2,count=33 20110830: date=20110830,domain=ymail.com,type=3,count=14 However splunkd seems to be running the script every one second. This causes many duplicate events. I want the script to run once a day as it outputs counts of feedback events for the previous day. How can I make the script run once a day after midnight? ... View more