Splunk Search

Is there an SPL search for Searches (saved or scheduled) that run in Real time?

SamHTexas
Builder

Is there an SPL search for Searches (saved or scheduled) that run in Real time? Should the all scheduled or saved searches be saved on the SH?

Labels (1)
Tags (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

In Alerts for Splunk Admins 

SearchHeadLevel - Realtime Scheduled Searches are in use

SearchHeadLevel - Realtime Search Queries in dashboards

SearchHeadLevel - Scheduled Searches without a configured earliest and latest time

 

Or even:

SearchHeadLevel - Dashboard refresh intervals

 

Might help...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

SamHTexas
Builder

Howdy sir, no. Due to only 2 of us in the Security team. It is hard to take time off at this time. Are you attending?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm planning to attend.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, saved searches will on the SH.  This search should do what you need.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search is_scheduled=1 disabled=0 
| fields dispatch.earliest_time eai:acl.owner title eai:acl.app 
| rename dispatch.earliest_time as earliest_time, eai:acl.owner as Owner, eai:acl.app as App
| where (earliest_time=="rt")
| table App Owner title
---
If this reply helps you, an upvote would be appreciated.

SamHTexas
Builder

Thank u. let me give it a test drive, I owe you lunch for all the help you have provided when you visit Texas. Have a safe day.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Will you be in Las Vegas for .conf21?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!