Splunk Search

How to track the run times of saved and scheduled searches?

rwi
Engager

I am looking to track the run times of analytics as well as create logs of the run times of the analytics in order to create a dashboard where you can see the run times of these saved searches as well as other relevant statistics (average length of time of search).  Any experience in doing this?

Labels (1)
0 Karma

rwi
Engager

Rich,

This worked okay! However, what is the difference between utilizing the scheduler.log and 
|rest /servicesNS/-/-/saved/searches ?

I am not getting the same results back concerning the scheduled searches. Some in scheduler.log do not appear in the |rest......

@richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The API shows what searches are configured, whereas the log shows what executed.

I don't know why some searches would be in the log, but not in the API.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I understand the use case correctly, the scheduler log should have that information.  Start with index=_internal source=*scheduler.log

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...