https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158538#M185869 <P>Anyone know how to do this on the latest version of Splunk 6.x?</P> <P>This doesn't appear to work anymore.</P> Fri, 10 Jun 2016 00:36:53 GMT phoenixdigital 2016-06-10T00:36:53Z https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158535#M185866 <P>I am new to splunk...<BR /> How to get List of realtime searches and the macro/savedSearch that runs on it?<BR /> Is there any splunk query command or index from which i can get required information..</P> Mon, 15 Dec 2014 10:17:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158535#M185866 paramagurukarth 2014-12-15T10:17:55Z https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158536#M185867 <P>Hi paramagurukarthikeyan,</P> <P>try this from the search bar:</P> <PRE><CODE>| rest /services/search/jobs | search eventSorting=realtime </CODE></PRE> <P>cheers, MuS</P> Mon, 15 Dec 2014 10:31:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158536#M185867 MuS 2014-12-15T10:31:28Z https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158537#M185868 <P>Thank you Michael... This is what i was looking for <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 15 Dec 2014 11:09:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158537#M185868 paramagurukarth 2014-12-15T11:09:41Z https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158538#M185869 <P>Anyone know how to do this on the latest version of Splunk 6.x?</P> <P>This doesn't appear to work anymore.</P> Fri, 10 Jun 2016 00:36:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158538#M185869 phoenixdigital 2016-06-10T00:36:53Z https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158539#M185870 <P>Hi @phoenixdigital, what exactly are you after? The REST call still works in 6.4.1</P> Fri, 10 Jun 2016 02:47:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158539#M185870 MuS 2016-06-10T02:47:25Z https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158540#M185871 <P>I was trying to get a list of all saved searches that would use a realtime search.</P> <P>Maybe because I am using a clustered search head the results are not consistent.</P> Fri, 10 Jun 2016 04:42:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158540#M185871 phoenixdigital 2016-06-10T04:42:26Z https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158541#M185872 <PRE><CODE>| rest /servicesNS/-/-/search/jobs splunk_server=local | search eventSorting=realtime </CODE></PRE> <P>Works for me in Splunk 6.5</P> <PRE><CODE>| rest /servicesNS/-/-/search/jobs | search eventSorting=realtime </CODE></PRE> <P>Works for me on Splunk 6.5</P> Tue, 07 Feb 2017 23:45:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-List-of-realtime-searches-and-the-macro-savedSearch/m-p/158541#M185872 jpapp 2017-02-07T23:45:45Z