How to edit my search to display the status of my saved searches?

[ramstolentino]

Hi, I am currently using the search below to get the status of my saved searches.

index=_internal sourcetype=scheduler | eval dispatch_time=strftime(dispatch_time, "%B %d %H:%M:%S") | table savedsearch_name status dispatch_time run_time result_count | sort dispatch_time

However, I want to see the following status:

1. running;
2. not running
3. completed ("success" is OK)

Any suggestions? Thanks!

[tlam_splunk]

I think your search command is trying to get the status from the scheduler.log.
In scheduler.log, I don’t think it has the ‘running' status. In general, you could take status = success As 'completed' , other than success, you could take it as ‘not completed’.

[woodcock]

Why not use the REST API?

| rest/servicesNS/-/-/saved/searches

[cmerriman]

by "not running" are you referring to saved searches that are not on a schedule? otherwise, in my opinion, if they are "not running" they would be "completed". I've never seen a "running" status, but I suppose i've never looked while i had a search running before.