Reporting

How to add cron schedule in a field

dogaasad
New Member

I want to create a report that displays my saved search name, status, and the cron schedule that is set.
I don't know how to add the cron schedule of a certain search in the report.
Also, I do not see a field in index=_internal sourcetype=scheduler that relates to cron schedule.
Can you please help?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The cron schedule is available using REST.

| rest splunk_server=local /servicesNS/-/-/saved/searches
| fields title is_scheduled
| search is_scheduled=1

You'll have to combine that with your _internal search to get the status.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...