topic How do you get a list of disabled saved searches and the time since when they were disabled? in Reporting

How do you get a list of disabled saved searches and the time since when they were disabled?

JuhiSaxena — Mon, 17 Dec 2018 09:35:30 GMT

We are using following query to report a list of disabled saved searches , however we want a time param to be appended in the table . Please advise.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search  disabled=1 is_scheduled=1 
| fields title eai:acl.owner eai:acl.app eai:acl.sharing 
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing

Re: How do you get a list of disabled saved searches and the time since when they were disabled?

damien_chillet — Mon, 17 Dec 2018 13:07:07 GMT

Since you are looking at searches that used to be scheduled I would suggest looking at last time it was run using the Splunk scheduler logs:

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search disabled=1 is_scheduled=1 
| fields title eai:acl.owner eai:acl.app eai:acl.sharing 
| join title type=left  [ search index=_internal sourcetype=scheduler | stats max(_time) as last_time by savedsearch_name | convert ctime(last_time) | rename savedsearch_name as title | fields title last_time]
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing last_time as "last time"

Note:
You won't be able to get last time it was run if it was longest time ago than the _internal index retention time.

Re: How do you get a list of disabled saved searches and the time since when they were disabled?

JuhiSaxena — Mon, 17 Dec 2018 14:15:30 GMT

Thank you for your response. However this query is flagging those searches as well which are Enabled [and not in disabled state].

Re: How do you get a list of disabled saved searches and the time since when they were disabled?

damien_chillet — Mon, 17 Dec 2018 14:44:53 GMT

Are you sure about that?
If you add disabled to the list of fields, you should see that all the searches in the table have disabled set to 1.

Re: How do you get a list of disabled saved searches and the time since when they were disabled?

JuhiSaxena — Mon, 17 Dec 2018 15:26:16 GMT

ok , i can now see it working. Ill get back to you after playing around with the query. Thanks a lot again.

Re: How do you get a list of disabled saved searches and the time since when they were disabled?

damien_chillet — Mon, 17 Dec 2018 15:28:54 GMT

Great, you welcome 🙂

Re: How do you get a list of disabled saved searches and the time since when they were disabled?

JuhiSaxena — Wed, 26 Dec 2018 14:23:04 GMT

Hi,
the time being picked is the scheduled time ie, when was the alert last scheduled to run. Is there any way to pick up the actual time when alert was disabled.