https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178661#M51389 <P>Do you capture Process information on the server? (may be using TA apps). If yes, then you might be able to track the process which is causing those peak CPU usage.</P> Fri, 15 Aug 2014 14:23:50 GMT rahulroy_splunk 2014-08-15T14:23:50Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178652#M51380 <P>I have this search</P> <P><CODE>host=MyIndeders sourcetype=cpu | multikv fields CPU pctUser | timechart span=5m avg(pctUser) AS "Avg % CPU" by host</CODE></P> <P>I can create a chart showing the CPU pegs at 100% for 10 minutes every hour.</P> <P>I want to find all scheduled jobs that are scheduled to run every hour to find the ones that I can stop.</P> <P>Anyone know how I can search for jobs in all apps that might run every hour?</P> Mon, 11 Aug 2014 22:19:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178652#M51380 hartfoml 2014-08-11T22:19:35Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178653#M51381 <P>You have to use the RESTAPI for this</P> <P><A href="http://">http://docs.splunk.com/Documentation/Splunk/6.1.2/RESTAPI/RESTsearch#saved.2Fsearches</A></P> <P>The returned values from the RESTAPI will help you to build your algorithm to stop the searches.</P> Tue, 12 Aug 2014 02:34:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178653#M51381 strive 2014-08-12T02:34:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178654#M51382 <P>Thanks I have been looking for about an hour now but have not been able to find the info useing rest api.</P> <P>I used this command <CODE>| rest /services/autherization/scheduledviews</CODE></P> <P>and was able to only see one scheduled view. I have not found the scheduled searches. any idea where to look?</P> Tue, 12 Aug 2014 16:00:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178654#M51382 hartfoml 2014-08-12T16:00:45Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178655#M51383 <P>Scheduled views (simple xml dashboards scheduled to run) are different from Scheduled searches (saved search scheduled to run). You should try using "|rest /services/saved/searches".</P> Tue, 12 Aug 2014 16:16:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178655#M51383 somesoni2 2014-08-12T16:16:44Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178656#M51384 <P>Thanks, this did show me about 30 saved searches. I know I have many more than that. of the 30 only 12 have something in the "cron_schedule" column. four of which are running every 5 minutes "*/5 * * * *". I am looking for expensive jobs that run every hour.</P> Tue, 12 Aug 2014 16:37:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178656#M51384 hartfoml 2014-08-12T16:37:49Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178657#M51385 <P>we have been using this rest API for quite sometime and it works fine. <BR /> Did you get a chance to login to SplunkWeb and check how many saved searches are there and indeed how many of them are scheduled?</P> Wed, 13 Aug 2014 07:03:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178657#M51385 strive 2014-08-13T07:03:49Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178658#M51386 <P>Yes I did thanks for the help, I looked as suggested by @somesoni above "|rest /services/saved/searches" and only found 30 saved searches and I know that I have way more than that. Also I only found 12 scheduled as I said above. So fare I have not been able to find the full list of scheduled jobs with there perspective cron schedule. Jo Joy just yet. thanks for the help. I will keep looking till I find the answer. Maybe I will get support to help; ARGG</P> Thu, 14 Aug 2014 13:24:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178658#M51386 hartfoml 2014-08-14T13:24:13Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178659#M51387 <P>You can get the historic run for scheduled searches from _internal index. Below search will give you list of scheduled search running every 3600 secs/1 hour, along with their run_time and result_count (which may help you identify expensive queries.</P> <PRE><CODE>index=_internal sourcetype=scheduler | table _time user savedsearch_name status scheduled_time run_time result_count | sort savedsearch_name _time | streamstats current=f window=1 first(scheduled_time) as prevSched by savedsearch_name | eval schedulingTime=scheduled_time-prevSched | where schedulingTime=3600 </CODE></PRE> Mon, 28 Sep 2020 17:20:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178659#M51387 somesoni2 2020-09-28T17:20:45Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178660#M51388 <P>Thanks @Somesoni2 this helps but I still can't find what is causing the 100 CPU spick every hour for 10 minutes. At least I know how to find the scheduled jobs thanks.</P> Thu, 14 Aug 2014 22:00:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178660#M51388 hartfoml 2014-08-14T22:00:16Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178661#M51389 <P>Do you capture Process information on the server? (may be using TA apps). If yes, then you might be able to track the process which is causing those peak CPU usage.</P> Fri, 15 Aug 2014 14:23:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178661#M51389 rahulroy_splunk 2014-08-15T14:23:50Z https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178662#M51390 <P>You're probably only looking at the current app context. You need to wildcard your query to force it to look at all apps:<BR /> <CODE> | rest /servicesNS/-/-/saved/searches <CODE></CODE></CODE></P> <P>Add a filter for is_scheduled=1 to see only the scheduled jobs. See <A href="https://answers.splunk.com/answers/221242/is-there-a-way-to-identify-all-scheduled-searches.html">https://answers.splunk.com/answers/221242/is-there-a-way-to-identify-all-scheduled-searches.html</A> for details.<BR /> </P> Tue, 20 Oct 2015 12:49:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-all-searches-that-are-scheduled-to-run-every-hour/m-p/178662#M51390 cphair 2015-10-20T12:49:09Z