topic Re: List of realtime searches showing deleted reports/alerts in Splunk Search

List of realtime searches showing deleted reports/alerts

shazbot79 — Mon, 23 Aug 2021 09:10:45 GMT

Hi, I have the following SPL as a dashboard panel which shows realtime searches. This is so I can contact the owners and discuss them converting to a scheduled report instead:

| rest /services/search/jobs | search eventSorting=realtime
| eval author=upper(author)
| lookup snow_sys_user_list.csv user_name as author
| table author label eventSearch dv_name dispatchState, eai:acl.owner, isRealTimeSearch, performance.dispatch.stream.local.duration_secs, runDuration, searchProviders, splunk_server

However, the panel is still showing reports that have been converted to scheduled reports/alerts or deleted entirely. Is there some SPL I have to add to get it to only see "active" real-time searches?

Thanks

Re: List of realtime searches showing deleted reports/alerts

shazbot79 — Mon, 23 Aug 2021 09:11:36 GMT

I have the time picker set to last 24 hours but if I change to last 5 minutes the problem persists.

Re: List of realtime searches showing deleted reports/alerts

jwalthour — Mon, 23 Aug 2021 10:12:45 GMT

how about adding …

| search dispatchState != “DONE”

Re: List of realtime searches showing deleted reports/alerts

shazbot79 — Mon, 23 Aug 2021 10:56:14 GMT

they all have a dispatchState of RUNNING, including the ones that have been amended/deleted....

Re: List of realtime searches showing deleted reports/alerts

jwalthour — Mon, 23 Aug 2021 11:01:54 GMT

Then, are you sure you’ve stopped the jobs?

Re: List of realtime searches showing deleted reports/alerts

shazbot79 — Mon, 23 Aug 2021 12:13:28 GMT

Ah....so even if the user deletes their report the job keeps running?