All Apps and Add-ons

Is there a way to generate a graph / chart that shows performance of scheduler?

neerajs_81
Builder

hi, is there a way to generate a graph / chart that shows performance of Scheduler ?
We are using Splunk Enterprise Security and there is an App available called "Cloud Monitoring console" which shows stuff like "Skipped Searches" , "Scheduler Activity" etc but not quite what we are looking for.

We would like to see how many searches were kicked off ( as in dispatched)  every hour or every 30 mins, kind of plot run time of searches .  End goal is to identify if we have too many searches running at a particular time slot n so on.


Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You could start e.g. with this

index=_audit action IN (search, rtsearch, accelerate_search)
| timechart count by info

r. Ismo 

neerajs_81
Builder

i ran your search , not sure i understand the result set.  How is this related to scheduler activity and
What do the different values of "info" mean  as shown below ?  To make it simple, is there a way to restrict this data based on the app : SplunkEnterpriseSecurity ? 

neerajs_81_0-1682501959691.png

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...