Reporting

Problem with scheduled reports

wsadowy1
Explorer

I have several reports scheduled to run at the same time with a window set to 5 minutes.
When the time they were scheduled to passes and I type the following command into the search window to check the status of these reports, it turns out almost none of them did run:

index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") |search sched="2016-09-23 10:15:00"| table sched status savedsearch_name

I also see sos_refresh_splunk_servers_cache under savedsearch_name a lot of times.
What is it, and how can I make these reports run as scheduled?
Thank you

0 Karma

inventsekar
Ultra Champion

on inputs.conf, what info you have for [search] stanza.

can you run this for last 24hrs (or last 7 days) and check how many active_hist_searches and active_realtime_searches are there..

 index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | table active_hist_searches active_realtime_searches
0 Karma

wsadowy1
Explorer

I'm using Web Splunk and I don't know how to open the inputs.conf file unfortunately.
As for the search you provieded. I ran it for the past 7 days and got over 190k rows of results. Would you like me to give you the sums of active_hists and active_realtime fields?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...