https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/545854#M154712 <P>Thank u. let me give it a test drive, I owe you lunch for all the help you have provided when you visit Texas. Have a safe day.</P> Mon, 29 Mar 2021 12:56:35 GMT SamHTexas 2021-03-29T12:56:35Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/545772#M154674 <P>Is there an SPL search for Searches (saved or scheduled) that run in Real time? Should the all scheduled or saved searches be saved on the SH?</P> Sun, 28 Mar 2021 20:17:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/545772#M154674 SamHTexas 2021-03-28T20:17:06Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/545781#M154678 <P>Yes, saved searches will on the SH.&nbsp; This search should do what you need.</P><LI-CODE lang="markup">| rest splunk_server=local /servicesNS/-/-/saved/searches | search is_scheduled=1 disabled=0 | fields dispatch.earliest_time eai:acl.owner title eai:acl.app | rename dispatch.earliest_time as earliest_time, eai:acl.owner as Owner, eai:acl.app as App | where (earliest_time=="rt") | table App Owner title</LI-CODE> Mon, 29 Mar 2021 00:21:27 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/545781#M154678 richgalloway 2021-03-29T00:21:27Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/545854#M154712 <P>Thank u. let me give it a test drive, I owe you lunch for all the help you have provided when you visit Texas. Have a safe day.</P> Mon, 29 Mar 2021 12:56:35 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/545854#M154712 SamHTexas 2021-03-29T12:56:35Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555499#M157687 <P>Will you be in Las Vegas for .conf21?</P> Fri, 11 Jun 2021 17:52:17 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555499#M157687 richgalloway 2021-06-11T17:52:17Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555501#M157689 <P>Howdy sir, no. Due to only 2 of us in the Security team. It is hard to take time off at this time. Are you attending?</P> Fri, 11 Jun 2021 17:58:12 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555501#M157689 SamHTexas 2021-06-11T17:58:12Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555526#M157702 <P>I'm planning to attend.</P> Fri, 11 Jun 2021 23:11:15 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555526#M157702 richgalloway 2021-06-11T23:11:15Z https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555583#M157724 <P>In <A href="https://splunkbase.splunk.com/app/3796/" target="_self">Alerts for Splunk Admins&nbsp;</A></P><P><SPAN>SearchHeadLevel - Realtime Scheduled Searches are in use</SPAN></P><P><SPAN>SearchHeadLevel - Realtime Search Queries in dashboards</SPAN></P><P><SPAN>SearchHeadLevel - Scheduled Searches without a configured earliest and latest time</SPAN></P><P>&nbsp;</P><P><SPAN>Or even:</SPAN></P><P><SPAN>SearchHeadLevel - Dashboard refresh intervals</SPAN></P><P>&nbsp;</P><P><SPAN>Might help...</SPAN></P> Sun, 13 Jun 2021 05:48:30 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-an-SPL-search-for-Searches-saved-or-scheduled-that-run/m-p/555583#M157724 gjanders 2021-06-13T05:48:30Z