How to display the timerange of cron schedule in dashboard

[madanashok]

Hi Splunkers,

There is a need for me to display at what duration the saved search is running in dashboard panel.

specifically in html module.

For instance the cron schedule is 00,20,40 * * * *

I want to display like the search is running at 12.20 - 12.40 in html module.Likewise 1.10-1.30 .

Thanks,
Madan

[jonuwz · Accepted solution]

This is only an approximation.

This gets you

1) the time range covered by the last run search (range)

2) the difference between searchLatestTime for the current and the previous job (interval)

Providing the cron schedule is regular (i.e runs at the same interval always) the output for interval will be reasonably accurate.

| rest /services/search/jobs 
| search isSavedSearch=1
| stats max(searchEarliestTime) as sET max(searchLatestTime) as sLT list(searchLatestTime) as times by label
| eval range=strftime(sET,"%H:%M")." - ".strftime(sLT,"%H:%M")
| eval interval=strftime(mvindex(times,1),"%H:%M")." - ".strftime(mvindex(times,0),"%H:%M")
| table label range interval

The cron schedule is exposed like this, but its ugly :

| rest /servicesNS/-/-/saved/searches | search is_scheduled=1 | table title cron_schedule

[jonuwz]

Good. If this answers your question, please consider accepting the answer.

[madanashok]

Excellent jonuwz...I got what i wanted.