Dashboards & Visualizations

Is there an efficient way to access earliestTime/latestTime of a scheduled search in a dashboard?

cphair
Builder

I have a monthly scheduled search whose data I loadjob into a dashboard. I'd like to display the timeframe on the dashboard for the most recent run of the search, so users know whether they're looking at the most current data--not when it was supposed to run, but when it actually ran. Is there a rest search command or something to access the earliest/latest data for the most recent run of a scheduled search?

0 Karma

pradeepkumarg
Influencer

Audit logs should give you the information you are looking for

index=_audit source=audittrail savedsearch_name="YOUR_SAVED_SEARCH_NAME"| convert ctime(search_et) as EARLIEST| convert ctime(search_lt) as LATEST
0 Karma
Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider from Postmark to AWS Simple Email ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...