Hi, How can I add delay between two commands in Splunk.
I have a scenario,
1) where I will append the search results to existing lookup file,
2) in second step I need to retrieve complete results and perform lookup activities search results in this step
If I use in single query, I am worried that before exporting results to lookup file the second query may execute. SO thinking to add delay between to commands
Simply:
After using |outputlookup command to export results to file, I need to use lookup command to map latest results in file to specific search results. But worries if lookup command executes parallel with outputlookup command, Which will happed incomplete result mapping
Is it possible?
↧