Splunk Cloud Platform

How to get SVC Usage for Saved Searches and Ad-hoc searches

weidertc
Contributor

How can I get the SVC Usage for Saved Searches and Ad-hoc searches?  These logs don't have it.

index="_internal" data.searchType="scheduled"

 

index="_audit" sourcetype="audittrail" action="search" info="completed"

 

Labels (1)

_JP
Contributor

Have you taken a look in your Monitoring Console within the Splunk UI? E.g. 

 

$Your Splunk Instance$/app/splunk_monitoring_console/scheduler_activity_instance

 

 

_JP_1-1698271380844.png

 

You can also open up the searches for those various panels to see what data they are looking at (a lot of them are hitting REST endpoints)

 

(on edit:  I am now realizing that you might be referring to specific SVC usage from a cloud perspective and not just "what are my scheduled searches doing?  But if this sort of metric doesn't exist for the cloud admin dashboards, maybe they should...)

 

 

0 Karma

weidertc
Contributor

I don't have access to this app.  I will ask an admin though.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...