Dear Splunkers.
I have a form, where I am loading a drop down, using a lookup file, that searches the top products. I am using.
><![CDATA[|inputlookup top-products.csv]]>
The top-products.csv is a result of outputting the search results of the top products. <!--
index = "ssh" | dedup product | table product | outputlookup products-table.csv
called as Search-Product-->
I then use one of the products selected in the drop down for creating a search string. All works fine. I now need to make sure I always get the correct and updated set of products in the drop down. This probably requires me to run the search " Search-Product" above, regularly like every day, so that I can get the updated results every day..
Is there a way to schedule a search like :
index = "ssh" | dedup product | table product | outputlookup products-table.csv
on a daily basis or hourly basis?
Dak
Yes. Save your search. Go to Manager > saved searches > edit the saved search related to this. Click the check box labeled "schedule this search", and it'll expand all the options you have available for scheduling a search to run automatically.
Hope this helps.
Yes. Save your search. Go to Manager > saved searches > edit the saved search related to this. Click the check box labeled "schedule this search", and it'll expand all the options you have available for scheduling a search to run automatically.
Hope this helps.
Converted your answering comment to a proper answer, again.