Hi,
I'm beginning to see "skipped jobs" pop-up more frequently, along with maximum search messages. Is there a search that can show me scheduled searches and their frequency?
| rest /services/saved/searches | where is_scheduled=1 | table title cron_schedule eai:acl.app
| rest /services/saved/searches | where is_scheduled=1 | table title cron_schedule eai:acl.app
Thanks!
The above method is best, but an alternative is:
in the backend server, do a grep on "dispatch.earliest_time" on all "savedsearches.conf"
eg
find /opt/splunk/etc/apps -type f -name "savedsearches.conf" -exec grep "dispatch.earliest_time" {} \;