Hi,
I have a scheduled data input script in Splunk which runs every hour, the script is a basic wget from a web server, sometimes that web server is not responding well and causing us to lose data of an hour.
Is there any way to check if data has arrived and if not re-run the script? or any other more efficent way to retreive data from the web server?
the reason why we have this on an hourly cron is that the data only changes once an hour, and I have noticed that when we run it multiple times we get duplicate data in our searches(maybe there is a way to overcome this?)
Thanks in advance
The best option in my opinion is to build this logic into the script instead.
You could run a scheduled search every hour to alert you whenever there is no/not enough data in the previous hour.
I thought about that but I wanted some more generic/automatic option.. the alert can trigger the script and then it will populate the data - that should work right?
Is there any more basic way to do it? it seems like some workaround