I am looking to track the run times of analytics as well as create logs of the run times of the analytics in order to create a dashboard where you can see the run times of these saved searches as well as other relevant statistics (average length of time of search). Any experience in doing this?
Rich,
This worked okay! However, what is the difference between utilizing the scheduler.log and
|rest /servicesNS/-/-/saved/searches ?
I am not getting the same results back concerning the scheduled searches. Some in scheduler.log do not appear in the |rest......
@richgalloway
The API shows what searches are configured, whereas the log shows what executed.
I don't know why some searches would be in the log, but not in the API.
If I understand the use case correctly, the scheduler log should have that information. Start with index=_internal source=*scheduler.log