https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135914#M3050 <P>Hi philip.wong,</P> <P>assuming you forward all internal search head logs to your indexer[s], you can start searching the scheduler.log:</P> <PRE><CODE> index=_internal source=*scheduler.log | timechart span=5m count by status </CODE></PRE> <P>which will give you a quick overview on how many searches were ran and if they all were successful or not. <BR /> I recommend the <A href="http://apps.splunk.com/app/748/">S.o.S. App</A> as well, it makes daily Splunk life easier.</P> <P>hope this helps to get you started ...</P> <P>cheers, MuS</P> Tue, 04 Feb 2014 13:14:32 GMT MuS 2014-02-04T13:14:32Z https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135913#M3049 <P>As Splunk administrator I'm interested to have monitoring on frequency of search that user's schedule searches. So we can have better control or ask user to tune down frequency and not to overload the search head.</P> Tue, 04 Feb 2014 04:28:39 GMT https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135913#M3049 philip_wong 2014-02-04T04:28:39Z https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135914#M3050 <P>Hi philip.wong,</P> <P>assuming you forward all internal search head logs to your indexer[s], you can start searching the scheduler.log:</P> <PRE><CODE> index=_internal source=*scheduler.log | timechart span=5m count by status </CODE></PRE> <P>which will give you a quick overview on how many searches were ran and if they all were successful or not. <BR /> I recommend the <A href="http://apps.splunk.com/app/748/">S.o.S. App</A> as well, it makes daily Splunk life easier.</P> <P>hope this helps to get you started ...</P> <P>cheers, MuS</P> Tue, 04 Feb 2014 13:14:32 GMT https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135914#M3050 MuS 2014-02-04T13:14:32Z https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135915#M3051 <P>"assuming you forward all internal search head logs to your indexer[s]"</P> <P>Looks like it has another issue. I can see the user searches concern me from local scheduler.log and indexer's splunkd_access.log. However, I couldn't search as you said from SH. I've already set "forwardedindex.filter.disable = true" in search head's outputs.conf</P> Wed, 05 Feb 2014 10:14:24 GMT https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135915#M3051 philip_wong 2014-02-05T10:14:24Z https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135916#M3052 <P>take a look at <A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad">http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad</A> the 'default behavior' section <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 05 Feb 2014 12:14:07 GMT https://community.splunk.com/t5/Reporting/How-to-check-schedule-search-frequency-by-Splunk-search/m-p/135916#M3052 MuS 2014-02-05T12:14:07Z