Getting Data In

Scheduled saved Search that is meant to fill a Summary Index, runs but with no data

Dark_Ichigo
Builder

I have created a summary index and a saved search to run via cron configured in saved_searches.conf, the only issue is that its not running at the specified time and if it managed to run, it doesn't fill up the summary index, UNLESS I manually click on "Jobs" and select the scheduled saved search that's running in the background and run it my self, then it will be successfully filled.

What could be the reason for this behavior?

I have taken a look at some of the other questions but they don't seem to solve my issue.

Below is a copy of one of my scheduled saved Searches that isn't working:

[Search_Name]
action.email.inline = 1
action.summary_index = 1
action.summary_index._name = SummaryIndex
alert.severity = 2
alert.suppress = 1
alert.suppress.period = 1h
alert.track = 1
# run hourly
cron_schedule = 5 * * * *
description = <Description>
ased on MPM Logs
dispatch.earliest_time = -1h@h
dispatch.latest_time = now
enableSched = 1
realtime_schedule = 0
search = `Search_Name`

and a Copy of one of my scheduled saved Searches that is working:

[Search_Name2]
action.email.inline = 1
action.email.reportServerEnabled = 0
action.summary_index = 1
action.summary_index._name = SummaryIndex
alert.digest_mode = True
alert.severity = 2
alert.suppress = 1
alert.suppress.period = 1h
alert.track = 1
# run hourly
cron_schedule = 35 * * * *
description = <Description>
dispatch.earliest_time = -1h@h
dispatch.latest_time = now
enableSched = 1
realtime_schedule = 0
search = `Search_Name2`

Please Note: Both raw searches (not the Summary Indexed) are populated with data and work, so when I run the raw macros search for each, I get results.

0 Karma

lakshman239
Influencer

check your cron . for every 5 mins, it should be */5 * * * * and use same approach for other.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...