you can search scheduler.log with a search like this.
index=_internal sourcetype=scheduler alert_actions!="" | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time
You can filter on additional fields ie: user=admin or app=search
index=_internal sourcetype=scheduler alert_actions!="" user=admin | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time
If you want to filter on role(s) your group is part of you will will need to grab roles from another source and join it to the original search on user
first run this search to create a lookup table with user and roles:
| rest/services/authentication/current-context | dedup username | table username roles | rename username as user | outputlookup user_role.csv
then run this search:
index=_internal sourcetype=scheduler alert_actions!="" | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time | join user [|inputlookup user_role.csv] | table savedsearch_name user roles app alert_actions status run_time | search roles=admin
you can search scheduler.log with a search like this.
index=_internal sourcetype=scheduler alert_actions!="" | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time
You can filter on additional fields ie: user=admin or app=search
index=_internal sourcetype=scheduler alert_actions!="" user=admin | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time
If you want to filter on role(s) your group is part of you will will need to grab roles from another source and join it to the original search on user
first run this search to create a lookup table with user and roles:
| rest/services/authentication/current-context | dedup username | table username roles | rename username as user | outputlookup user_role.csv
then run this search:
index=_internal sourcetype=scheduler alert_actions!="" | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time | join user [|inputlookup user_role.csv] | table savedsearch_name user roles app alert_actions status run_time | search roles=admin
Still works in 2020! Great answer
under the time picker there is an option to export to .csv
Sorry got the information thanks 🙂
Thank Sir !! i will go ahead and check will let you know and the Could you please let me know if there is any way to get export those data