topic Re: How can I count different types of Splunk searches in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334351#M165497 <P>Hey @arpit_arora, saw this in the queue twice--this post is now live and the other one was closed. I edited to include the second title.</P> Wed, 25 Oct 2017 20:55:28 GMT lfedak_splunk 2017-10-25T20:55:28Z How can I count different types of Splunk searches https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334350#M165496 <P>Hello, I am reading the following resource from Splunk documentation and I find that there are 8 types of searches in Splunk.<BR /> I am listing them below.<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Dispatchdirectoryandsearchartifacts">https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Dispatchdirectoryandsearchartifacts</A></P> <P>(1) Local ad hoc search<BR /> (2) Saved search<BR /> (3) Scheduled search<BR /> (4) Remote search<BR /> (5) Real-time search<BR /> (6) Replicated search<BR /> (7) Replicated scheduled search<BR /> (8) Report acceleration search</P> <P>I am trying to understand how can I count the number of such searches.</P> Wed, 25 Oct 2017 20:39:25 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334350#M165496 arpit_arora 2017-10-25T20:39:25Z Re: How can I count different types of Splunk searches https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334351#M165497 <P>Hey @arpit_arora, saw this in the queue twice--this post is now live and the other one was closed. I edited to include the second title.</P> Wed, 25 Oct 2017 20:55:28 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334351#M165497 lfedak_splunk 2017-10-25T20:55:28Z Re: How can I count different types of Splunk searches https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334352#M165498 <P>Lots of those categories intermingle - some are run-time/past and some aren't.</P> <P>As long as you are going for everything, you might as well add "skipped search" to the list.</P> Wed, 25 Oct 2017 21:48:58 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334352#M165498 DalJeanis 2017-10-25T21:48:58Z Re: How can I count different types of Splunk searches https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334353#M165499 <P>@arpit_arora , (Disitributed) Management Console or DMC built in to Splunk provides a lot of these insights. You have merged Search <CODE>Modes</CODE> (Real-Time, Historical, etc) and Search <CODE>Types</CODE> (Scheduled, Report Acceleration, Datamodel Acceleration etc) together. </P> <P>You should check out following two Dashboards under <CODE>DMC &gt; Search</CODE> </P> <UL> <LI>1) Search Activity: Instance (Splunk Docs Reference: <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/SearchactivityDeploymentwide">http://docs.splunk.com/Documentation/Splunk/latest/DMC/SearchactivityDeploymentwide</A>)</LI> <LI>2) Scheduler Activity: Instance (Splunk Docs Reference: <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Scheduleractivity">http://docs.splunk.com/Documentation/Splunk/latest/DMC/Scheduleractivity</A>)</LI> </UL> <P>By Changing the Group By dropdown to <CODE>Mode</CODE> or <CODE>Type</CODE>, you should be able to gather analytical information as per your need. If not you can build your own query on top of these as per your use case.</P> Mon, 30 Oct 2017 15:41:22 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-different-types-of-Splunk-searches/m-p/334353#M165499 niketn 2017-10-30T15:41:22Z