Dashboards & Visualizations

Is there an efficient way to access earliestTime/latestTime of a scheduled search in a dashboard?

cphair
Builder

I have a monthly scheduled search whose data I loadjob into a dashboard. I'd like to display the timeframe on the dashboard for the most recent run of the search, so users know whether they're looking at the most current data--not when it was supposed to run, but when it actually ran. Is there a rest search command or something to access the earliest/latest data for the most recent run of a scheduled search?

0 Karma

pradeepkumarg
Influencer

Audit logs should give you the information you are looking for

index=_audit source=audittrail savedsearch_name="YOUR_SAVED_SEARCH_NAME"| convert ctime(search_et) as EARLIEST| convert ctime(search_lt) as LATEST
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...