topic Re: Saved searches Run time in Splunk Search

Saved searches Run time

izzie123 — Fri, 30 Jun 2023 17:41:14 GMT

Hello Splunkers,

I had a question, I wanted to check the time on which my saved searches / scheduled reports and alerts are running. Is there a way we can list out the name of the searches and at what time are they running?

Also, how can we find out which saved searches are running at the same time?

Re: Saved searches Run time

richgalloway — Sat, 01 Jul 2023 03:39:18 GMT

You can use REST to get a list of scheduled searches and their scheduled times.

This query is derived from the Extended Search Reporting dashboard by dpaper at https://github.com/dpaper-splunk/public/blob/master/dashboards/extended_search_reporting.xml. It sorts searches by their scheduled times so you can see which ones run at the same time.

| rest /servicesNS/-/-/saved/searches splunk_server=local search="is_scheduled=1" search="disabled=0" earliest_time=-1h@m latest_time=now timeout=0 | table title cron_schedule scheduled_times | mvexpand scheduled_times | rename scheduled_times as _time | sort + _time

Re: Saved searches Run time

izzie123 — Mon, 03 Jul 2023 10:31:49 GMT

This worked for me, thanks. I was able to list out the searches by tweaking this query a little bit.

We see that there are many searches running in at the same time, any ideas on how we can tune this?

Re: Saved searches Run time

richgalloway — Mon, 03 Jul 2023 11:40:27 GMT

Manually reschedule searches so fewer of them run at the same time.