How to track scheduled search which are using "All Time" time window?

[athorat]

We have a few users scheduling searches using "all time", time frame.

How can I track those knowledge objets and delete / Pause them?

[gcusello]

Hi @athorat,

adding a bit to the perfect answer of @danspav, you could disable the all time searches for the role of these users putting a limit to the time frame that they can use.

Ciao.

Giuseppe

[danspav]

Hi @athorat,

You can see all the scheduled searches that are enabled with an earliest time as "all time" with the below:

| rest /servicesNS/-/-/saved/searches search="is_scheduled=1" search="disabled=0" search="dispatch.earliest_time=0"  timeout=0
| table dispatch.earliest_time, title, eai:acl.app, eai:acl.owner, search

However, people can get around this by:

• Using the term "earliest=-10y" in their searches
• Using 1 instead of 0 for the dispatch.earliest_time
• Hiding the earliest/latest in a macro or subsearch

But that should find the immediate culprits for you.

You can also look in the _audit index to find searches being run with all time:

index=_audit action=search info=completed search_et IN(0,"N/A")
| stats count, sum(total_run_time) as total_run_time values(provenance) as provenance by app, user
| fieldformat total_run_time=tostring(total_run_time,"duration")
| sort - total_run_time

There are ways to avoid appearing in this search, but that should give you a good starting point.

Cheers,
Daniel