Reporting
Highlighted

History of a saved search

Communicator

Is it possible to get the history of when a saved search was executed? This will allow me to see if the cron schedule is working correctly.

Tags (1)
0 Karma
Highlighted

Re: History of a saved search

Splunk Employee
Splunk Employee

Any chance you are on Splunk 5?

| history

Returns a history of searches formatted as an events list or as a table.

For 4.3 please try this:

index=_audit ( splunk_server=local) action=search (id=* OR search_id=*)
| eval search_id=if(isnull(search_id), id, search_id)
| replace '*' with * in search_id
| search search_id!=rt_* search_id!=searchparsetmp*
| rex "search='(?<search>.*?)', autojoin"
| rex "savedsearch_name=\"(?<savedsearch_name>.*?)\"\]\["

View solution in original post

Highlighted

Re: History of a saved search

Communicator

No I am on the latest 4.x version. That shows the contents of searches.log which does not contain the name of the saved search.

0 Karma
Highlighted

Re: History of a saved search

Splunk Employee
Splunk Employee

Here is a search I stole from SoS.

index=_audit ( splunk_server=local) action=search (id=* OR search_id=*)
| eval search_id=if(isnull(search_id), id, search_id)
| replace '*' with * in search_id
| search search_id!=rt_* search_id!=searchparsetmp*
| rex "search='(?<search>.*?)', autojoin"
| rex "savedsearch_name=\"(?<savedsearch_name>.*?)\"\]\["

Highlighted

Re: History of a saved search

Communicator

Error: Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side

0 Karma
Highlighted

Re: History of a saved search

Splunk Employee
Splunk Employee

can you please try the one I just added to the answer? I think maybe in comments the code doesn't format properly.

0 Karma
Highlighted

Re: History of a saved search

Communicator

a simple approach would be to look at scheduler.log

0 Karma