https://community.splunk.com/t5/Splunk-Enterprise-Security/Where-can-I-see-ES-content-searches-performance-in-terms-of-avg/m-p/647772#M11570 <P>You should be able to get that information from the scheduler log.</P><LI-CODE lang="markup">index=_internal source=*scheduler.log run_time=* | stats avg(run_time) by savedsearch_name</LI-CODE> Wed, 21 Jun 2023 12:12:45 GMT richgalloway 2023-06-21T12:12:45Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Where-can-I-see-ES-content-searches-performance-in-terms-of-avg/m-p/647696#M11569 <P>Where can I see ES content searches performance in terms of avg. time taken to run a particular correlation rule or saved search?</P> Thu, 22 Jun 2023 00:44:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Where-can-I-see-ES-content-searches-performance-in-terms-of-avg/m-p/647696#M11569 deodeshm 2023-06-22T00:44:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Where-can-I-see-ES-content-searches-performance-in-terms-of-avg/m-p/647772#M11570 <P>You should be able to get that information from the scheduler log.</P><LI-CODE lang="markup">index=_internal source=*scheduler.log run_time=* | stats avg(run_time) by savedsearch_name</LI-CODE> Wed, 21 Jun 2023 12:12:45 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Where-can-I-see-ES-content-searches-performance-in-terms-of-avg/m-p/647772#M11570 richgalloway 2023-06-21T12:12:45Z