Search scheduling reports

[jambajuice]

Is there a search that will show me what time all searches are scheduled for over a 24 hour period? Broken out by minute? I think our indexer is getting overloaded by a bunch of searches that all kick off at the same time. I'd like to see what minutes of the day have the most amount of searches scheduled for them.

Thx.

[Ant1D]

You could try the following search:

index=_internal savedsearch_name=* scheduled_time=* | convert timeformat="%a %b %d %H:%M:%S %Y" ctime(scheduled_time) | stats count list(scheduled_time) by savedsearch_name | sort savedsearch_name