Splunk Dev

Cron job condition when running DBX query

k_harini
Communicator

Hi,
I have a condition where we have to run dbxquery command based on scheduling condition.. Only on Mondays between 8 am to 2 pm.. Incase if Monday is public holiday it should run on Tuesday.. How can we achieve this?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Run the Monday one with a regular cron then every year go through and figure out when the holiday things are and setup INDIVIDUAL jobs for each Tuesday, writing the queries in such a way that the Tuesday run always overwrites the previous day's run.

0 Karma

k_harini
Communicator

How to make Tuesday run overwrite? Here we have used saved search with dbxquery and summary indexed the data.. I can have a look up list of public holidays. With tat how can I change cron job?

0 Karma

woodcock
Esteemed Legend

Keep the same search that should end in | collectand add to it something like this:

| search ThisFieldDoesNotExist="So this will throw away all the events we just saved"
| append [ search [|makeresults | eval search = "earliest=-1d@d latest=0d@d-1" | table search] index="YourSummaryIndexHere"
|delete ]
0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...