Reporting

Display list of scheduled report and number of rows

spammenot66
Contributor

Is there a way to get list of scheduled report and get the following:
1) when report was last ran,
2) display number of rows returned per report?

0 Karma

Manoj_g
New Member

@spammenot66

Try this
* index=_internal sourcetype=scheduler savedsearch_id=* status=* | timechart span=5m count by status
* index=_internal sourcetype=scheduler savedsearch_id=* status=* | stats count by reason
* index=_internal sourcetype=scheduler savedsearch_name=* status=success |stats  count by  savedsearch_name, scheduled_time | search count>1

0 Karma

somesoni2
Revered Legend

Do you want list of all scheduled reports (and alerts) or just the one which are currently active?

0 Karma

renjith_nair
Legend

@spammenot66,

Try

  index=_internal source="*scheduler.log" savedsearch_id=* 
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

pradeepkumarg
Influencer

index=_internal sourcetype=scheduler status=success | table _time savedsearch_name result_count

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...