Splunk Search

How to track the run times of saved and scheduled searches?

rwi
Engager

I am looking to track the run times of analytics as well as create logs of the run times of the analytics in order to create a dashboard where you can see the run times of these saved searches as well as other relevant statistics (average length of time of search).  Any experience in doing this?

0 Karma

rwi
Engager

Rich,

This worked okay! However, what is the difference between utilizing the scheduler.log and 
|rest /servicesNS/-/-/saved/searches ?

I am not getting the same results back concerning the scheduled searches. Some in scheduler.log do not appear in the |rest......

@richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The API shows what searches are configured, whereas the log shows what executed.

I don't know why some searches would be in the log, but not in the API.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the use case correctly, the scheduler log should have that information.  Start with index=_internal source=*scheduler.log

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...