topic Splunk search command that returns fields from view "Manager » Searches and reports" in Splunk Search

Splunk search command that returns fields from view "Manager » Searches and reports"

lpolo — Mon, 18 Jun 2012 17:35:50 GMT

Is there a Splunk search command that returns information found in "Manager » Searches and reports" view?

For example, I need to know all the search names and search scheduled time configured in a particular indexer using a search command.

Thanks,
Lp

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

sdaniels — Tue, 19 Jun 2012 11:43:47 GMT

Look at the details from this search. I'm not sure I see a scheduled time but it gives you alot of details for your searches.

| rest /services/saved/searches

After you see the fields you want just simplify the table with specific columns.

| rest /services/saved/searches  | table title search

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

lpolo — Tue, 19 Jun 2012 11:57:58 GMT

Yes. I did the work. The returned fields are the ones I need.

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

lpolo — Tue, 19 Jun 2012 12:12:06 GMT

It seems that is not returning all the scheduled searches for all the apps. Is there an ending point call for each app?

Thanks,
Lp

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

sdaniels — Tue, 19 Jun 2012 13:01:52 GMT

Seems to be retriving searches for the search app only.

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

lpolo — Tue, 19 Jun 2012 13:11:43 GMT

Search = | rest /services/saved/searches | table title search
If I execute the search from this app:

http://hostname:8000/en-US/app/search/dashboard_live

I get the same result set if I run the same search from one of our apps:

http://hostname:8000/en-US/app/metrics_abc/search_view

Both apps have different scheduled searches configured.

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

sdaniels — Tue, 19 Jun 2012 13:26:38 GMT

This shows what has run and shows searches outside of just the search app. Might be a way to sort/dedup this for information that you want.

| rest /services/search/jobs

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

lpolo — Tue, 19 Jun 2012 14:50:11 GMT

It improved. I can see all scheduled searches that ran or are running.
Is there a way to get what is found in the "Manager » Searches and reports" view?

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

sdaniels — Tue, 19 Jun 2012 15:05:07 GMT

Not that I can find.

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

lpolo — Tue, 19 Jun 2012 16:43:25 GMT

Could you ask to your colleagues in Splunk Tech Support of Dev?
Thanks,
Lp

Re: Splunk search command that returns fields from view "Manager » Searches and reports"

sideview — Tue, 19 Jun 2012 19:58:24 GMT

You can download a 90 day trial of Sideview Utils 2.0, because it packages a splunkentity command that will do what you want:

| splunkentity /saved/searches app="some_app"

Granted, knowing what the entity path is for a particular kind of Manager object can be a little tricky, but you can often figure it out and when in doubt you can ask me.

go here, then on the right you'll see 'download trial'.
http://sideviewapps.com/apps/sideview-utils/

Especially if you've ever created or edited a view in the Advanced XML, there are many powerful reasons to check out Sideview Utils 2.0. To be honest although the splunkentity command is quite useful it falls so far down on that list that I have yet to write up a docs page for it.