Splunk Enterprise

time taken by instrumentation searches to run

ankitarath2011
Path Finder

I want to know the execution time of scheduled alerts in splunk_instrumentation apps which are scheduled at 3 am.  Nothing is showing when I am opening the "View Recent" option. Even in job manager nothing is showing. 

Following are the alerts

instrumentation.usage.smartStore.config
instrumentation.usage.workloadManagement.report
instrumentation.usage.authMethod.config
instrumentation.usage.healthMonitor.report
instrumentation.usage.passwordPolicy.config

Labels (2)
0 Karma
1 Solution

codebuilder
SplunkTrust
SplunkTrust

You try something like this:

index=_internal sourcetype=scheduler  | table _time user savedsearch_name status scheduled_time run_time result_count
----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

ankitarath2011
Path Finder

thanks @codebuilder 

codebuilder
SplunkTrust
SplunkTrust

You try something like this:

index=_internal sourcetype=scheduler  | table _time user savedsearch_name status scheduled_time run_time result_count
----
An upvote would be appreciated and Accept Solution if it helps!
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...