Splunk 101: Scheduling with Cron Expressions
In this video tutorial, I'll discuss the importance of using the Cron Expression when scheduling in Splunk. Cron may seem tricky to use, but once you get the system nailed down, it will save you a ton of time by automating your report generation. Here are some takeaways from the video when you're using Crons expression in Splunk...
https://kinneygroup.com
Key Takeaways...
When scheduling a report, you'll need to establish when it runs, how it runs, how often it runs etc. To make a report functional and consistent, it's important to schedule out your report.
Unless it's weekly or monthly, you shouldn't use the standard report scheduling options in Splunk... use Cron expressions.
Avoid backed up reporting and stagger the time in which your reports fire off... instead of scheduling all of your reports at the top of the hour, break those up to release minute by minute in batches. This will help your reports send on time and not back up your system and lower your chances of failed or skipped searches.
If you have a reoccurring report that's scheduled to release frequently throughout the day, consider pushing your results to a summary indexer.
Prioritize your reports when scheduling and indicate which reports should send first.