https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/603050#M209873 <P>very good!!</P> Thu, 23 Jun 2022 17:11:39 GMT jo 2022-06-23T17:11:39Z https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532632#M150464 <P>How to find long-running searches in Splunk, with execution time in mins.</P> Thu, 23 Jun 2022 17:25:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532632#M150464 shinde0509 2022-06-23T17:25:40Z https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532641#M150468 <P>The Monitoring Console has a dashboard for that.&nbsp; See Settings-&gt;Monitoring Console-&gt;Search-&gt;Search Usage Statistics: Instance then scroll down.</P> Thu, 10 Dec 2020 13:46:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532641#M150468 richgalloway 2020-12-10T13:46:15Z https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532659#M150475 <P>Not having access to Monitoring Consoles, SO using SPL want to create dashboard.</P> Thu, 10 Dec 2020 14:58:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532659#M150475 shinde0509 2020-12-10T14:58:54Z https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532688#M150488 <P>If you don't have access to the MC then you probably don't have access to the _internal index, which is where run times are reported.</P> Thu, 10 Dec 2020 17:39:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532688#M150488 richgalloway 2020-12-10T17:39:43Z https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532751#M150513 <P>Having access to _internal and _audit Indexes.</P> Fri, 11 Dec 2020 07:34:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532751#M150513 shinde0509 2020-12-11T07:34:47Z https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532800#M150521 <P>This should get you started.</P><LI-CODE lang="markup">(index=_audit host=* action=search sourcetype=audittrail search_id!="rsa_*") | eval user = if(user="n/a", null(), user) | eval search_id=replace(search_id, "'(.*)'", "\1") | eval search=if(isnull(savedsearch_name) OR savedsearch_name=="", search, savedsearch_name) | stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id</LI-CODE> Fri, 11 Dec 2020 13:40:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/532800#M150521 richgalloway 2020-12-11T13:40:06Z https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/603050#M209873 <P>very good!!</P> Thu, 23 Jun 2022 17:11:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-long-running-searches-in-Splunk-with-execution-time/m-p/603050#M209873 jo 2022-06-23T17:11:39Z