I want to know the execution time of scheduled alerts in splunk_instrumentation apps which are scheduled at 3 am. Nothing is showing when I am opening the "View Recent" option. Even in job manager nothing is showing.
Following are the alerts
instrumentation.usage.smartStore.config
instrumentation.usage.workloadManagement.report
instrumentation.usage.authMethod.config
instrumentation.usage.healthMonitor.report
instrumentation.usage.passwordPolicy.config
You try something like this:
index=_internal sourcetype=scheduler | table _time user savedsearch_name status scheduled_time run_time result_count
thanks @codebuilder
You try something like this:
index=_internal sourcetype=scheduler | table _time user savedsearch_name status scheduled_time run_time result_count