Getting Data In

How to set up cron schedule for per minute data summary index?

abhayneilam
Contributor

Hi,

Currently I am trying to set up a summary indexing , so there will be three summary indexes for each service
1. Summary index for per day
2. Summary index for per hour
3. Summary index for per minute

I have set up a plan how I can go ahead with "day" and "hour" as follows :

DAY : index="XXXX" source="XXXXXXXXX" earliest=-1d@d latest=-0d@d | bucket _time span=1day | sistats count avg(XX) max(XX) min(XX) by _time, A,B,C,D,E

cron : 00 01 * * *

I am running on the last 1 day data on each day at 01:00 clock in the morning

HOUR : index="XXXXX" source="XXXXXXXX" earliest=-1h@h latest=-0h@h | bucket _time span=1h | sistats count avg(XX) max(XX) min(XX) by _time, A,B,C,D,E

cron= 10 * * * *

so the cron is each hour 10 minutes my search will run for the last one hour

I am not able to find the solution for PER MINUTE data, how should I make my search and how to set up cron effectively. Mainly I need to set up a search that fits the following requirements:
o Search for data between 10:20 and 10:30
o Execute this search by cron at 10:35, for example
o Use 1 minute spanning in the search
o Extend this example to cover a complete hour instead of 10:20 to 10:30

Please help me asap , your help is very much appreciated !!

Thanks in advance !!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can use a timerange of -15m@m to -5m@m and have a cron schedule of 5,15,25,35,45,55 * * * *. The run at 35 past the hour will then search from 20 past the hour to 30 past the hour.
For one-minute spans just set span=1m.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can use a timerange of -15m@m to -5m@m and have a cron schedule of 5,15,25,35,45,55 * * * *. The run at 35 past the hour will then search from 20 past the hour to 30 past the hour.
For one-minute spans just set span=1m.

martin_mueller
SplunkTrust
SplunkTrust

One search is enough. The comma-separated list of minutes works within one cron schedule.
http://en.wikipedia.org/wiki/Cron#CRON_expression

0 Karma

abhayneilam
Contributor

Martin,

Do we need more than one search to get this configured ?

0 Karma

abhayneilam
Contributor

Thanks Martin_Mueller for the prompt reply !! Really much appreciated

0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...