Knowledge Management

How to track scheduled search which are using "All Time" time window?


We have a few users scheduling searches using "all time", time frame.

How can I track those knowledge objets and delete / Pause them?

Labels (1)
0 Karma


Hi @athorat,

adding a bit to the perfect answer of @danspav, you could disable the all time searches for the role of these users putting a limit to the time frame that they can use.



0 Karma


Hi @athorat,

You can see all the scheduled searches that are enabled with an earliest time as "all time" with the below:



| rest /servicesNS/-/-/saved/searches search="is_scheduled=1" search="disabled=0" search="dispatch.earliest_time=0"  timeout=0
| table dispatch.earliest_time, title,, eai:acl.owner, search




However, people can get around this by:

  • Using the term "earliest=-10y" in their searches
  • Using 1 instead of 0 for the dispatch.earliest_time
  • Hiding the earliest/latest in a macro or subsearch

But that should find the immediate culprits for you.


You can also look in the _audit index to find searches being run with all time:



index=_audit action=search info=completed search_et IN(0,"N/A")
| stats count, sum(total_run_time) as total_run_time values(provenance) as provenance by app, user
| fieldformat total_run_time=tostring(total_run_time,"duration")
| sort - total_run_time



There are ways to avoid appearing in this search, but that should give you a good starting point.


0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...