topic Re: How can I find all scheduled searches that have a timeframe of 'All time'? in Splunk Search

How can I find all scheduled searches that have a timeframe of 'All time'?

cwhelan — Tue, 16 May 2023 12:32:31 GMT

I am looking to find all scheduled searches within the environment that are using a timeframe of 'All time' e.g. if a search is scheduled to run every hour and is using timeframe of 'All time', I would like to change that search to use 'Last 60 minutes' instead.

Any helpful searches would be appreciated!

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

richgalloway — Tue, 16 May 2023 13:50:05 GMT

Here is a search I use to help me find all-time searches. It's not perfect, but definitely helps.

| rest splunk_server=local /servicesNS/-/-/saved/searches | search is_scheduled=1 disabled=0 | fields dispatch.earliest_time dispatch.latest_time eai:acl.owner eai:acl.sharing search cron_schedule title eai:acl.app schedule_window | where NOT like(title, "_ScheduledView_%") | rex field=search "(?<base>^\|+)" | rex field=base "earliest\s*=\s*(?<earliest>[^\|\s]+)" | rename dispatch.earliest_time as earliest_time, dispatch.latest_time as latest_time, eai:acl.owner as Owner, eai:acl.sharing as Sharing, eai:acl.app as App | where (earliest_time<100 AND isnull(earliest) and NOT match(base,"^\|"))

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

Taruchit — Tue, 16 May 2023 21:03:10 GMT

Hi @cwhelan,

Please share if the below code helps you get the results: -

index=_audit search_et="N/A" search_lt="N/A" user!="splunk-system-user" |rex "\s+savedsearch\_name=\"(?<searchName>[\w\d\_\-]*[^\"])" |stats count BY searchName

Thank you

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

cwhelan — Thu, 18 May 2023 13:28:01 GMT

Thanks a lot guys.

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

Taruchit — Thu, 18 May 2023 19:02:48 GMT

Hi @richgalloway,

It would be very helpful if you could share your inputs/feedback on the SPL that I posted.

Thank you

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

richgalloway — Thu, 18 May 2023 20:56:26 GMT

This query will detect ad-hoc as well as scheduled searches, but only finds those that actually ran during the search window. It won't report on those that are scheduled to run at another time.

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

cwhelan — Fri, 19 May 2023 07:48:22 GMT

@richgalloway By any chance, is it possible to find how much space on disk a search used? e.g. some users are running ad-hoc searches that frequently exceed 10GB in disk size.

I tried editing Taruchit's search but couldn't find any fields in _audit relating to search size on disk.

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

Taruchit — Sat, 20 May 2023 02:49:20 GMT

Hi @richgalloway,

Thank you for sharing.

If I modify the rex to avoid capturing empty string for field "savedsearch_name", in your opinion does that help to solve the problem of avoiding ad-hoc searches in the result?

Thank you

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

richgalloway — Sat, 20 May 2023 12:05:57 GMT

Yes, that would help. However, because the audit log only contains searches that have run in the time range, the query will not detect searches that are scheduled but have not yet run.

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

richgalloway — Mon, 22 May 2023 18:08:30 GMT

The only place I've found disk usage information is in the Job Inspector.

Re: How can I find all scheduled searches that have a timeframe of 'All time'?

Taruchit — Thu, 25 May 2023 12:51:33 GMT

Thank you for sharing your inputs.