Reporting
Highlighted

RFE: capability to set expiration date for scheduled searches

Champion

We have a lot of users that create scheduled searches and walk away (forget about them). We'd like the capability to set an expiration date on scheduled searches so that they automatically become either unscheduled or disabled on some date -- set at the time the search is configured.

Also would be nice to be able to set a default expiration date for all scheduled searches -- which can be overridden, of course.

0 Karma
Highlighted

Re: RFE: capability to set expiration date for scheduled searches

Influencer

Is this a question? 😉
Or an enhancement request?

0 Karma
Highlighted

Re: RFE: capability to set expiration date for scheduled searches

Champion

The trouble I see with this is that the only place where you get an indication of when the search was created is in the local.meta. None of the eai: fields as returned by, say, | rest /services/saved/searches contain the time at which the search was authored. I might attack this from the filesystem, cruising through local.meta files.

0 Karma
Highlighted

Re: RFE: capability to set expiration date for scheduled searches

Influencer

Hmmm, I seem to remember a related question a while ago that led me to look and it appears that local.meta only contains the last modification time. But that may be good enough.
How about indexing all metadata directories with a little (CRC) salt? That may be a good exercise in coming up with props/transforms for these... 😉 But then you could probably run a search that identifies all saved searches that are old (modtime) and haven't run in a while (index=_audit) and check with owners/delete.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.