Splunk Search

How to track the run times of saved and scheduled searches?

rwi
Engager

I am looking to track the run times of analytics as well as create logs of the run times of the analytics in order to create a dashboard where you can see the run times of these saved searches as well as other relevant statistics (average length of time of search).  Any experience in doing this?

Labels (1)
0 Karma

rwi
Engager

Rich,

This worked okay! However, what is the difference between utilizing the scheduler.log and 
|rest /servicesNS/-/-/saved/searches ?

I am not getting the same results back concerning the scheduled searches. Some in scheduler.log do not appear in the |rest......

@richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The API shows what searches are configured, whereas the log shows what executed.

I don't know why some searches would be in the log, but not in the API.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the use case correctly, the scheduler log should have that information.  Start with index=_internal source=*scheduler.log

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...