Reporting

History of a saved search

peter_gianusso
Communicator

Is it possible to get the history of when a saved search was executed? This will allow me to see if the cron schedule is working correctly.

Tags (1)
0 Karma
1 Solution

okrabbe_splunk
Splunk Employee
Splunk Employee

Any chance you are on Splunk 5?

| history

Returns a history of searches formatted as an events list or as a table.

For 4.3 please try this:

index=_audit ( splunk_server=local) action=search (id=* OR search_id=*)
| eval search_id=if(isnull(search_id), id, search_id)
| replace '*' with * in search_id
| search search_id!=rt_* search_id!=searchparsetmp*
| rex "search='(?<search>.*?)', autojoin"
| rex "savedsearch_name=\"(?<savedsearch_name>.*?)\"\]\["

View solution in original post

peter_gianusso
Communicator

a simple approach would be to look at scheduler.log

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Any chance you are on Splunk 5?

| history

Returns a history of searches formatted as an events list or as a table.

For 4.3 please try this:

index=_audit ( splunk_server=local) action=search (id=* OR search_id=*)
| eval search_id=if(isnull(search_id), id, search_id)
| replace '*' with * in search_id
| search search_id!=rt_* search_id!=searchparsetmp*
| rex "search='(?<search>.*?)', autojoin"
| rex "savedsearch_name=\"(?<savedsearch_name>.*?)\"\]\["

okrabbe_splunk
Splunk Employee
Splunk Employee

can you please try the one I just added to the answer? I think maybe in comments the code doesn't format properly.

0 Karma

peter_gianusso
Communicator

Error: Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Here is a search I stole from SoS.

index=_audit ( splunk_server=local) action=search (id=* OR search_id=*)
| eval search_id=if(isnull(search_id), id, search_id)
| replace '*' with * in search_id
| search search_id!=rt_* search_id!=searchparsetmp*
| rex "search='(?<search>.*?)', autojoin"
| rex "savedsearch_name=\"(?<savedsearch_name>.*?)\"\]\["

peter_gianusso
Communicator

No I am on the latest 4.x version. That shows the contents of searches.log which does not contain the name of the saved search.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...