Reporting

don't start a new scheduled search if current one is not finished

flyingmouse
New Member

Hi, I have a scheduled search which runs every 15 mins. It is not for summary index, so by default it should be a real time scheduling.

is there any parameter I can set, so that if the current scheduled search is not finished,the scheduler won't start a new one?

Thanks

Tags (1)
0 Karma

flyingmouse
New Member

Hi MuS,

Thanks a lot for your reply. But what I understand is for any search which is not for summary index, Splunk will automatically set realtime_schedule to be 1. so that's why i am a little bit confused to see there two instances of this search pending

0 Karma

MuS
SplunkTrust
SplunkTrust

hi flyingmouse

according to the excellent docs @ splunk this could be done in savedsearchs.conf with with option realtime_schedule

realtime_schedule = [0|1]
* Controls the way the scheduler computes the next execution time of a scheduled search.
* If this value is set to 1, the scheduler bases its determination of the next scheduled search 
  execution time on the current time. 
* If this value is set to 0, the scheduler bases its determination of the next scheduled search 
  on the last search execution time. This is called continuous scheduling.
*    If set to 1, the scheduler might skip some execution periods to make sure that the scheduler 
     is executing the searches running over the most recent time range.  
*    If set to 0, the scheduler never skips scheduled execution periods. However, the execution 
     of the saved search might fall behind depending on the scheduler's load. Use continuous 
     scheduling whenever you enable the summary index option.
* The scheduler tries to execute searches that have realtime_schedule set to 1 before it
  executes searches that have continuous scheduling (realtime_schedule = 0).
* Defaults to 1

hope this helps, cheers

MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...