Search scheduling reports


Is there a search that will show me what time all searches are scheduled for over a 24 hour period? Broken out by minute? I think our indexer is getting overloaded by a bunch of searches that all kick off at the same time. I'd like to see what minutes of the day have the most amount of searches scheduled for them.


0 Karma


You could try the following search:

index=_internal savedsearch_name=* scheduled_time=* | convert timeformat="%a %b %d %H:%M:%S %Y" ctime(scheduled_time) | stats count list(scheduled_time) by savedsearch_name | sort savedsearch_name

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...