Splunk Search

How to determine if searches are being executed each hour the number of times expected per their cron configuration

Vignesh-107
Path Finder

I have a saved search need to check the each hour the search is being executed based on the cron configuration.


Expected Result:

Savedsearch NameCron configNumber of time executedSearch
Sav1  */5 * * * *12Search ran all 12 times
Sav2*/10 * * * *6Search skipped at 5 run

 

 

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

In alerts for splunk admins https://splunkbase.splunk.com/app/3796/ there is an example alert for skipped searches and the reason

 

This finds which searches were skipped.

View solution in original post

gjanders
SplunkTrust
SplunkTrust

In alerts for splunk admins https://splunkbase.splunk.com/app/3796/ there is an example alert for skipped searches and the reason

 

This finds which searches were skipped.

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...