Dashboards & Visualizations

Is there an efficient way to access earliestTime/latestTime of a scheduled search in a dashboard?

cphair
Builder

I have a monthly scheduled search whose data I loadjob into a dashboard. I'd like to display the timeframe on the dashboard for the most recent run of the search, so users know whether they're looking at the most current data--not when it was supposed to run, but when it actually ran. Is there a rest search command or something to access the earliest/latest data for the most recent run of a scheduled search?

0 Karma

pradeepkumarg
Influencer

Audit logs should give you the information you are looking for

index=_audit source=audittrail savedsearch_name="YOUR_SAVED_SEARCH_NAME"| convert ctime(search_et) as EARLIEST| convert ctime(search_lt) as LATEST
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...