How to know if scheduled searches are used in some dashboards or for alerting?

[muizash]

Actually, some scheduled searches are taking lot of CPU usage, I want to know if they are used in dashboards or used for the purpose of alerting, so that if they are used for dashboards, i could decrease the frequency of those searches.
Thanks

[woodcock]

Check if the scheduled searches have any of these features:

SPL commands `sendemail` OR `outputlookup` (and possibly others like service now ones that start with `snow*`, depending on what apps you have installed and what custom commands they create and what those commands do)
Alert actions of any kind.
Referenced inside of other SPL (dahsboards, panels, reports, or saved searches) through `| loadjob` or `| savedsearch`.

[gcusello]

Hi muizash,
usually scheduled searches aren't used in dashboards but only in alerts and to populate lookups or summaries or reports to use in dashboards.
To understand if you can modify frequency of your scheduled searches, you should at first point the the heaviest ones and see their own scope (alert, lookup, summary or report).
So you can choose if the frequency is correct or not:

• if not correct, you can modify it,
• otherwise, the only way is to scale architecture adding CPUs to Search Heads and/or Indexers or adding additional servers.

Ciao.
Giuseppe

[punyanit]

This search will list the scheduled searches with the scheduled time, and status. From here you can see if the scheduled is getting used anywhere or not

index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") | table sched status savedsearch_name

Then you can use below to list all the scheduled searches and then compare the results

| rest /services/saved/searches search="is_scheduled=1"