How can I find all scheduled searches that have a timeframe of 'All time'?

[cwhelan]

I am looking to find all scheduled searches within the environment that are using a timeframe of 'All time' e.g. if a search is scheduled to run every hour and is using timeframe of 'All time', I would like to change that search to use 'Last 60 minutes' instead.

Any helpful searches would be appreciated!

[cwhelan]

Thanks a lot guys.

[Taruchit]

Hi @cwhelan,

Please share if the below code helps you get the results: -

index=_audit search_et="N/A" search_lt="N/A" user!="splunk-system-user"
|rex "\s+savedsearch\_name=\"(?<searchName>[\w\d\_\-]*[^\"])"
|stats count BY searchName

Thank you

[richgalloway]

This query will detect ad-hoc as well as scheduled searches, but only finds those that actually ran during the search window.  It won't report on those that are scheduled to run at another time.

[Taruchit]

Hi @richgalloway,

Thank you for sharing.

If I modify the rex to avoid capturing empty string for field "savedsearch_name", in your opinion does that help to solve the problem of avoiding ad-hoc searches in the result?

Thank you

[richgalloway]

Yes, that would help.  However, because the audit log only contains searches that have run in the time range, the query will not detect searches that are scheduled but have not yet run.

[Taruchit]

Thank you for sharing your inputs.

[Taruchit]

Hi @richgalloway,

It would be very helpful if you could share your inputs/feedback on the SPL that I posted.

Thank you

[richgalloway · Accepted solution]

Here is a search I use to help me find all-time searches.  It's not perfect, but definitely helps.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search is_scheduled=1 disabled=0 
| fields dispatch.earliest_time dispatch.latest_time eai:acl.owner eai:acl.sharing search cron_schedule title eai:acl.app schedule_window
| where NOT like(title, "_ScheduledView_%")
| rex field=search "(?<base>^\|+)"
| rex field=base "earliest\s*=\s*(?<earliest>[^\|\s]+)"
| rename dispatch.earliest_time as earliest_time, dispatch.latest_time as latest_time, eai:acl.owner as Owner, eai:acl.sharing as Sharing, eai:acl.app as App
| where (earliest_time<100 AND isnull(earliest) and NOT match(base,"^\|"))

[cwhelan]

@richgalloway By any chance, is it possible to find how much space on disk a search used? e.g. some users are running ad-hoc searches that frequently exceed 10GB in disk size.

I tried editing Taruchit's search but couldn't find any fields in _audit relating to search size on disk.

[richgalloway]

The only place I've found disk usage information is in the Job Inspector.