Reporting

Display list of scheduled report and number of rows

spammenot66
Contributor

Is there a way to get list of scheduled report and get the following:
1) when report was last ran,
2) display number of rows returned per report?

0 Karma

Manoj_g
New Member

@spammenot66

Try this
* index=_internal sourcetype=scheduler savedsearch_id=* status=* | timechart span=5m count by status
* index=_internal sourcetype=scheduler savedsearch_id=* status=* | stats count by reason
* index=_internal sourcetype=scheduler savedsearch_name=* status=success |stats  count by  savedsearch_name, scheduled_time | search count>1

0 Karma

somesoni2
Revered Legend

Do you want list of all scheduled reports (and alerts) or just the one which are currently active?

0 Karma

renjith_nair
Legend

@spammenot66,

Try

  index=_internal source="*scheduler.log" savedsearch_id=* 
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

pradeepkumarg
Influencer

index=_internal sourcetype=scheduler status=success | table _time savedsearch_name result_count

0 Karma
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...