https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314654#M94200 <P>can i please know what the user name " nobody" means ? because real time searches will impact the performance of indexers.</P> Wed, 22 Feb 2017 21:13:43 GMT kteng2024 2017-02-22T21:13:43Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314652#M94198 <P>Below is the search i am using to find the real time schedule searches .. but i would like to know which user is running, name of the search, and if possible, when those searches were launched?</P> <PRE><CODE>index=_internal source=*scheduler.log run_time=* search_type!="scheduled" | stats count by search_type </CODE></PRE> Wed, 22 Feb 2017 17:30:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314652#M94198 kteng2024 2017-02-22T17:30:24Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314653#M94199 <P>try this (though you may need/want to do some editing/formating on the <CODE>savedsearch_name</CODE> and <CODE>sheduled_time</CODE> fields):</P> <PRE><CODE>index=_internal source=*scheduler.log run_time=* search_type!="scheduled" | stats count by search_type user savedsearch_name scheduled_time </CODE></PRE> Wed, 22 Feb 2017 18:08:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314653#M94199 cmerriman 2017-02-22T18:08:42Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314654#M94200 <P>can i please know what the user name " nobody" means ? because real time searches will impact the performance of indexers.</P> Wed, 22 Feb 2017 21:13:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314654#M94200 kteng2024 2017-02-22T21:13:43Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314655#M94201 <P>this link has some descriptions of "nobody"</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Access_Control_List">http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTUM/RESTusing#Access_Control_List</A></P> Thu, 23 Feb 2017 12:40:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314655#M94201 cmerriman 2017-02-23T12:40:57Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314656#M94202 <P>Nobody means EITHER the KO was installed by adding an app OR that the owner who created it has been deleted from splunk.</P> Sat, 25 Mar 2017 11:20:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-find-real-time-scheduled-searches/m-p/314656#M94202 woodcock 2017-03-25T11:20:04Z