topic Monitoring Console (MC) search activity is not recognizing saved search (scheduled search) in Monitoring Splunk

Monitoring Console (MC) search activity is not recognizing saved search (scheduled search)

brandy81 — Tue, 20 Jul 2021 13:47:47 GMT

Hi All,

At Monitoring Console (MC) --> Search Activity : Instance, there is "top 20 Memory-consuming searches", which is searching from index=_introspection.

As I run the search, it is not recognizing saved search (scheduled search). Why doesn't the search starting index=_introspection recognize saved search (scheduled search)? It seems not it returns results from all searches.

How do I get to know memory consumption of all searches including saved search(scheduled search)? Do I have to join index=_introspection and index=_audit?

Re: Monitoring Console (MC) search activity is not recognizing saved search (scheduled search)

codebuilder — Fri, 23 Jul 2021 19:51:46 GMT

The DMC does indeed report on saved/scheduled searches. If you are not seeing them you might want to verify that all your instances are forwarding their _introspection logs and/or if they are properly configured for monitoring by the DMC.

See the following for more:
https://docs.splunk.com/Documentation/Splunk/8.2.1/DMC/SearchactivityDeploymentwide
https://docs.splunk.com/Documentation/Splunk/8.2.1/DMC/DMCprerequisites