Dashboards & Visualizations

Is there an efficient way to access earliestTime/latestTime of a scheduled search in a dashboard?

cphair
Builder

I have a monthly scheduled search whose data I loadjob into a dashboard. I'd like to display the timeframe on the dashboard for the most recent run of the search, so users know whether they're looking at the most current data--not when it was supposed to run, but when it actually ran. Is there a rest search command or something to access the earliest/latest data for the most recent run of a scheduled search?

0 Karma

pradeepkumarg
Influencer

Audit logs should give you the information you are looking for

index=_audit source=audittrail savedsearch_name="YOUR_SAVED_SEARCH_NAME"| convert ctime(search_et) as EARLIEST| convert ctime(search_lt) as LATEST
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...