Splunk Search

List or View Scheduled searches

DavidHourani
Super Champion

Hello,

Does anyone have a search command to find / list all scheduled searches, the time they should run at and the time they ran ?

Thank you.

Regards,
David

Tags (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

You can view all the scheduled search using

| rest /services/saved/searches | where is_scheduled=1

To get a history of scheduled search , check the internal logs

index=_internal sourcetype=scheduler  | table _time user savedsearch_name status scheduled_time run_time result_count
Happy Splunking!

View solution in original post

inventsekar
Ultra Champion

Anyone got any ideas for this issue?!?!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can view all the scheduled search using

| rest /services/saved/searches | where is_scheduled=1

To get a history of scheduled search , check the internal logs

index=_internal sourcetype=scheduler  | table _time user savedsearch_name status scheduled_time run_time result_count
Happy Splunking!

triest
Communicator

As always, Splunk continues to improve and with the improvements, I would suggest a different search:

| rest /services/saved/searches search="is_scheduled=1"

What's the different between this and using rest with where?

In typically Splunk fashion, the earlier you do filtering, the more efficient the search should be. This should push the filtering down to the search peers which means they (potentially) return fewer results to the search head.

0 Karma

trav271
Explorer

While early filtering is a good rule of thumb, in this instance remember the "where" command is categorized as a Distributable Streaming search process, so this would also be done at the index level and more importantly can be done BEFORE the final output, so it does not necessarily generate more traffic as Splunk will send it down as well knowing this fact about the "where" command.

But, like I said, and learned from a great teacher I had, that is generally a good rule of thumb to follow 😉

Also, the above about Distributable Streaming goes for: eval, fields, rex, where, etc.

For the curious, here's a great read to understand how searching works wrt different commands:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Typesofcommands

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...