Reporting

Is it possible to determine the last time a saved search was executed?

kbecker
Communicator

I am looking to audit the non-scheduled saved searches that users have created, is there a way to obtain the last run time of each saved search?

Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee
index="_internal" (sourcetype="splunk_web_service" view "loading saved search") 
OR (sourcetype=splunkd_access "GET /servicesNS/" "/search/saved/searches") 
| rex "loading saved search \"(?<saved_search>[^\"]+)" 
| eval uri_decode = urldecode(uri) 
| rex field=uri_decode "saved\/searches\/(?<saved_search>[^\$]+)$" 
| search saved_search=* NOT saved_search="_new" 
| transaction saved_search maxspan=2s
| search sourcetype="splunk_web_service" AND sourcetype="splunkd_access" 
| stats first(user) as user last(_time) as last_run_time by saved_search 
| fieldformat last_run_time=strftime(last_run_time, "%m/%d/%Y %H:%M:%S")

netwrkr
Communicator

I know this query can be written better but it works :winking_face:

audit_searchlocal | audit_rexsearch | search search_id!=scheduler_* | search search=search* search!=*_internal* search!=*_audit* | search NOT audit_search* | search NOT audittrail

HTH

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...