Scheduled searches and alerts not scheduled

[python]

Hi,

How to query scheduled searches and alerts that is not scheduled?

[livehybrid]

Hi @python 

I see you have already accepted an answer to this, however I feel the answer isnt quite right, by using disabled=0 you are missing a bunch of searches which would otherwise be scheduled but have been disabled, so I feel you need to look for is_scheduled = 0 OR (disabled=1 AND is_scheduled = 1) as these are searches which would be scheduled if they werent disabled.

| rest /services/saved/searches
| search is_scheduled=0 OR (is_scheduled=1 AND disabled=1) alert_type=* 
| table disabled, is_scheduled, eai:acl.owner, eai:acl.app, title, qualifiedSearch, alert_type

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[kiran_panchavat · Accepted solution]

@python 

You can use this

is_scheduled=0 means Filters unscheduled searches.

| rest /services/saved/searches | where is_scheduled=0

To list all saved searches and alerts that are not scheduled

| rest /services/saved/searches
| search is_scheduled=0 alert_type=* disabled=0
| table title, qualifiedSearch, alert_type, is_scheduled, disabled

| rest /services/saved/searches 
| where is_scheduled=0 
| table title, description, search, eai:acl.owner, eai:acl.app