topic Re: How to fetch scheduled time and dispatched time of saved search? in Splunk Search

How to fetch scheduled time and dispatched time of saved search?

Taruchit — Mon, 12 Jun 2023 19:52:30 GMT

Hello All,

How do I find scheduled time and dispatch time of each saved search and alert?

The goal is to fetch the two timestamps and then find the magnitude of delay, if any.

I tried to use the below but I get the cron schedule and not the timestamp, even though while defining cron was not used.

|rest /servicesNS/-/-/saved/searches |search is_scheduled=1

Thus, I need your help and suggestions to build the same.

Thank you
Taruchit

Re: How to fetch scheduled time and dispatched time of saved search?

Taruchit — Mon, 12 Jun 2023 19:54:35 GMT

I had previously fetched a thread by @verbal_666 where he stated the problem of delays by comparing scheduled time and dispatched time and then approach to solve it.

Link to thread: https://community.splunk.com/t5/Splunk-Search/Scheduler-high-delay-in-dispatching/m-p/495213

However, in my query I am a step prior, where I need help to fetch details of scheduled search and dispatch search for each saved search.

Thank you

Re: How to fetch scheduled time and dispatched time of saved search?

verbal_666 — Tue, 13 Jun 2023 07:16:04 GMT

You can try to launch a search like this,

index=_internal sourcetype=scheduler savedsearch_name="**" | where scheduled_time<dispatch_time | eval Scheduled_Time=strftime(scheduled_time,"%F %T"),Dispath_Time=strftime(dispatch_time,"%F %T"),Time_Diff=strftime(dispatch_time-scheduled_time,"%M:%S") | where ! isnull(Time_Diff) | table _time host app savedsearch_name Scheduled_Time Dispath_Time Time_Diff | sort - Time_Diff

Re: How to fetch scheduled time and dispatched time of saved search?

Taruchit — Tue, 13 Jun 2023 10:15:17 GMT

Hi @verbal_666,

Thank you very much for your prompt help.

Taruchit

Re: How to fetch scheduled time and dispatched time of saved search?

Taruchit — Tue, 13 Jun 2023 17:11:15 GMT

Hi @verbal_666,

Do you have any documentation which shares about how data in dispatch_time is field is recorded in the backend by Splunk? If yes, it would be great if you could share it.

Thank you

Re: How to fetch scheduled time and dispatched time of saved search?

verbal_666 — Wed, 14 Jun 2023 05:01:26 GMT

Sorry, no.
I found those fields reading the log of Splunk itsself time ago, when i got problems with high time dispatching, and did some seaches with them.
The best thing, IMO, is reading all the Splunk logs with attention, there is some data very useful.
Or you can use the DMC and read the dashboards, where you can find also many interesting things.

Re: How to fetch scheduled time and dispatched time of saved search?

Taruchit — Wed, 14 Jun 2023 05:13:01 GMT

Thank you sir.