https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-get-a-scheduled-saved-search-creation/m-p/174087#M49932 <P>I do not want to run through _audit logs to find when the initial schedule kicked in. Rest call for the list of saved searches gives me only the updated date which doesn't help much.</P> Fri, 14 Aug 2015 03:52:26 GMT pradeepkumarg 2015-08-14T03:52:26Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-get-a-scheduled-saved-search-creation/m-p/174087#M49932 <P>I do not want to run through _audit logs to find when the initial schedule kicked in. Rest call for the list of saved searches gives me only the updated date which doesn't help much.</P> Fri, 14 Aug 2015 03:52:26 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-get-a-scheduled-saved-search-creation/m-p/174087#M49932 pradeepkumarg 2015-08-14T03:52:26Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-get-a-scheduled-saved-search-creation/m-p/174088#M49933 <P>Without looking at _audit or possibly access logs in _internal you're out of luck. And even that would potentially be an inexact science. Only one date, if that, is stored in default.meta / local.meta. All saved searches for an app are written to the same savedsearches.conf file (so file create date doesn't necessarily help in the general case either, unless it is the only saved search, and even then some other saved search could have been created first and later deleted.</P> <P>If you have a compelling business case for it you could file a P4 for it. Alternatively if you can move toward a Splunk management model where everything is in source control and the only way to a scheduled search was through a deployment pipeline, ideally your configuration management tools could provide auditing that could be searchable on it's own or indexed by Splunk even (but that is quite the journey to get there)</P> Fri, 14 Aug 2015 04:20:00 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-get-a-scheduled-saved-search-creation/m-p/174088#M49933 acharlieh 2015-08-14T04:20:00Z https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-get-a-scheduled-saved-search-creation/m-p/576163#M200780 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/67700">@pradeepkumarg</a>&nbsp;: Did you get the query to pull the creation time?</P> Wed, 24 Nov 2021 10:43:39 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-best-way-to-get-a-scheduled-saved-search-creation/m-p/576163#M200780 Zubbuz 2021-11-24T10:43:39Z