Reporting

How can I determine the lag between when an app's scheduled search is supposed to run and when it actually runs?

nnmiller
Contributor

Our scheduled searches seem to be lagging behind. I need a search to identify the delay between the scheduled time and the actual run time.

1 Solution

nnmiller
Contributor
index=_internal (host=) sourcetype=scheduler app= scheduled_time=* 
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S") | eval delay_in_start = (dispatch_time - scheduled_time) 
| eval scheduled_time=strftime(scheduled_time,"%Y-%m-%d %H:%M:%S") 
| eval dispatch_time=strftime(dispatch_time,"%Y-%m-%d %H:%M:%S") 
| table savedsearch_name,delay_in_start, scheduled_time, dispatch_time, time, run_time, status

Replace search_head_hostname with your search head name or IP address, replace app with the name of an app or remove it for all scheduled searches.

Hat tip: A very clueful customer

View solution in original post

nnmiller
Contributor
index=_internal (host=) sourcetype=scheduler app= scheduled_time=* 
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S") | eval delay_in_start = (dispatch_time - scheduled_time) 
| eval scheduled_time=strftime(scheduled_time,"%Y-%m-%d %H:%M:%S") 
| eval dispatch_time=strftime(dispatch_time,"%Y-%m-%d %H:%M:%S") 
| table savedsearch_name,delay_in_start, scheduled_time, dispatch_time, time, run_time, status

Replace search_head_hostname with your search head name or IP address, replace app with the name of an app or remove it for all scheduled searches.

Hat tip: A very clueful customer

RicoSuave
Builder

OHS MAIS GAWDS! IS EXACTLIES GUATS I GUAS LEWKANS FOUR! JEW HLEPS ME FIINDS THESE LAGERS IN MAI ENVIRONMENTS!

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...