How do you get a list of disabled saved searches and the time since when they were disabled?

[JuhiSaxena]

We are using following query to report a list of disabled saved searches , however we want a time param to be appended in the table . Please advise.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search  disabled=1 is_scheduled=1 
| fields title eai:acl.owner eai:acl.app eai:acl.sharing 
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing

[damien_chillet]

Since you are looking at searches that used to be scheduled I would suggest looking at last time it was run using the Splunk scheduler logs:

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search disabled=1 is_scheduled=1 
| fields title eai:acl.owner eai:acl.app eai:acl.sharing 
| join title type=left  [ search index=_internal sourcetype=scheduler | stats max(_time) as last_time by savedsearch_name | convert ctime(last_time) | rename savedsearch_name as title | fields title last_time]
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing last_time as "last time"

Note:
You won't be able to get last time it was run if it was longest time ago than the _internal index retention time.

[JuhiSaxena]

Thank you for your response. However this query is flagging those searches as well which are Enabled [and not in disabled state].

[damien_chillet]

Are you sure about that?
If you add disabled to the list of fields, you should see that all the searches in the table have disabled set to 1.

[JuhiSaxena]

ok , i can now see it working. Ill get back to you after playing around with the query. Thanks a lot again.

[damien_chillet]

Great, you welcome 🙂

[JuhiSaxena]

Hi,
the time being picked is the scheduled time ie, when was the alert last scheduled to run. Is there any way to pick up the actual time when alert was disabled.