Is is possible to setup an alerting condition on a scheduled saved search what would turn around and launch another saved search?
This may seem like a weird request, but here are some scenarios I've come across this week where I think such a function may be helpful. Or perhaps an better alternative is out there. Either way, I'm looking for ideas.
I've thought of a few ways to jerry-rig this, but nothing stands out as a good idea at the moment. If there is a way to use an triggered action script to make an API call to splunkd to setup a scheduled savedsearch to run just once, or a "run-now" mode that could probably do the trick.
The thing I like about having one scheduled saved search trigger another saved search is that such a mechanism could be done from within the scheduler and could therefore be managed and controlled by it.
Any thoughts or ideas?
Since I really haven't received any helpful feedback on this, and I'm not very good at sitting still, I've started working on my own solution to this problem by attempting to create a custom alerting action which will run a custom search command, which in turn will trigger the execution of a secondary saved search.
I've run into an issue getting the custom alerting action working, but again I'm just trying to figure out what I can based on existing config files.
I've had some success getting a custom search command to launch a saved search, but I've run into an bug that prevents the authentication session key from being usable by a search command.
I have published an app that gives me the functionality that I'm looking for:
This sounds like you want to use conditional alerting: