I want to have an alert which triggers when the results of two independent searches have data Search 1 = a simple search which will be contained within the alert/saved-search Search 2 = will be triggered with the results of search1 using custom searches written with python.
The script will perform the following
Results When searching from the Splunk web console with the command
By looking at the logfiles the script is run twice by splunk for some reason???
So to my questions
Why is it running twice when performing a search in Splunk?
Note the script is just a skeleton of what I plan to do but the main components are there. It works but just fills the original data with junk. I plan to fill it with the results of the second search.
I am using splunk 4.3 and my custom search is below.
So when performing this search in the Splunk search bar
The logfile has the following output
Any ideas how to stop it running twice
you can set in commands.conf
if you need to have
answered 06 Mar '12, 01:33
Thankyou for the suggestion but unfortuately that did not work. The script still runs twice.
However on closer inspection at a similar script I noticed that on the first pass it recieved 10 data points. Then on the second pass it recieved 17 data points.
So it appears Splunk it splitting up the results which is a shame as I would prefer my script recieve all data points at once for a given search.
Digging deeper again I can see that Splunk sends through one set of results then as it collects more sends the original set plus more results again. Below is a log of the _time and values of the two batches of data sent to the custom search.
answered 06 Mar '12, 16:55