How to check schedule search frequency by Splunk search?

[philip_wong]

As Splunk administrator I'm interested to have monitoring on frequency of search that user's schedule searches. So we can have better control or ask user to tune down frequency and not to overload the search head.

[MuS · Accepted solution]

Hi philip.wong,

assuming you forward all internal search head logs to your indexer[s], you can start searching the scheduler.log:

 index=_internal source=*scheduler.log | timechart span=5m count by status

which will give you a quick overview on how many searches were ran and if they all were successful or not.
I recommend the S.o.S. App as well, it makes daily Splunk life easier.

hope this helps to get you started ...

cheers, MuS

[MuS]

take a look at http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Routeandfilterdatad the 'default behavior' section 😉

[philip_wong]

"assuming you forward all internal search head logs to your indexer[s]"

Looks like it has another issue. I can see the user searches concern me from local scheduler.log and indexer's splunkd_access.log. However, I couldn't search as you said from SH. I've already set "forwardedindex.filter.disable = true" in search head's outputs.conf