Reporting

Is it possible to sync updates to index?

jimams
New Member

The scenario:

  1. via REST API, a scheduled search runs and updates an index, it adds values: Field1='A', Field2='1'; the splunk job is finished and finalized.
  2. via the REST API, the same scheduled search runs again and updates an index, it adds values: Field1='B', Field2='2'; the splunk job again is finished and finalized.
  3. another scheduled search runs and checks the content of the index ... but sometimes it only sees values Field1='A', Field2='1' ... it doesn't see the values submitted to the index the second time. When I run the same scheduled search a bit later, I already can see the values Field1='B', Field2='2'.

So, maybe it's a part of an optimization, but I would like to make sure in this particular case that when a job is done, the data is always available for another search after that.

Is there a way as how to achieve that? Thanks for any help!

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...