topic Re: Rest Query to find out query along with no of execution times in Splunk Search

Rest Query to find out query along with no of execution times

splunkfriend123 — Fri, 24 Jun 2022 14:28:25 GMT

Hi Team,

Is there any way to use REST syntax and retrieve the following.

1. Rest Query to retrieve all unique searches performed on a given index and count no of times it was searched

Re: Rest Query to find out query along with no of execution times

richgalloway — Fri, 24 Jun 2022 14:43:14 GMT

There is no REST command that does all that. You can use REST to search the audit log for all searches, but it won't be by index.

It's possible to parse the search strings to extract index names, but that's not perfect since index names may not be specified in the query itself. They may be in a macro or an eventtype or in the user's default indexes.

Re: Rest Query to find out query along with no of execution times

marysan — Sat, 25 Jun 2022 05:39:42 GMT

for _internal index for example:

| rest /services/saved/searches splunk_server=local count=0
| search cron_schedule!="* *" AND search="*index=_internal*"

when there is no cron schedule for a saved search, it cant execute .

Re: Rest Query to find out query along with no of execution times

Roy_9 — Sat, 25 Jun 2022 08:06:03 GMT

@splunkfriend123 there is no way to find the unique searches using REST command.

you could run the below search on audit index to get the details of adhoc, api and any scheduled searches.

Re: Rest Query to find out query along with no of execution times

PickleRick — Sat, 25 Jun 2022 08:50:42 GMT

It's a question that pops up quite frequently (auditing index accesses). Might be worth creating an idea on https://ideas.splunk.com/ or supporting existing one if someone already made one.