Reporting

How to get saved search's last successful run time

Communicator
-----
-----
------
| fields totalrec, mydate
| search index=_internal savedsearch_name="anothersavedsearch" status="success" 
| stats max(_time) as lastrun 
| eval lastsearchdate = if(totalrec>0,strftime(lastrun,"%Y-%m-%d"),mydate) 
| table lastsearchdate 

My requirement is, if the totalrec is greater than zero, then save lastsearchdate as saved search's last successful runtime, else store mydate to lastsearchdate.

But i am getting no records when i run this saved search. Please help.

0 Karma

Motivator

Modify the 7th line
Eval lastsearcheddate=(strftime(lastrun,format),mydate) | where totalrec>0

It will work

0 Karma

Communicator

This part is not correct strftime(lastrun,format),mydate)
so it didnt work.

0 Karma

Motivator

eval lastsearcheddate = strftime( strptime( lastrun, "%Y-%m-%d" ), mydate)

Could you please try this command

0 Karma

Champion

Hi,

you can find out last run of search with below query:

index=_internal source="/opt/splunk/var/log/splunk/scheduler.log" savedsearch_name=<scheduled-search-name> | eval lastRun=_time | 
0 Karma

Communicator

Thank you, but this query doesnt satisfy my requirement with respect to totalrec which i have got from previous lines in the same query.

0 Karma

Champion

Can you try using subsearch for getting lastrun.

Communicator

I tried already, but really not sure how to do it and i wasn't success

0 Karma

Communicator

Fixed the issue with subsearch, Thank you.

0 Karma