Saved searches Run time

[izzie123]

Hello Splunkers,

I had a question, I wanted to check the time on which my saved searches / scheduled reports and alerts are running. Is there a way we can list out the name of the searches and at what time are they running?

Also, how can we find out which saved searches are running at the same time?

[richgalloway]

You can use REST to get a list of scheduled searches and their scheduled times.

This query is derived from the Extended Search Reporting dashboard by dpaper at https://github.com/dpaper-splunk/public/blob/master/dashboards/extended_search_reporting.xml.  It sorts searches by their scheduled times so you can see which ones run at the same time.

| rest /servicesNS/-/-/saved/searches splunk_server=local search="is_scheduled=1" search="disabled=0" earliest_time=-1h@m latest_time=now timeout=0 
| table title cron_schedule scheduled_times 
| mvexpand scheduled_times 
| rename scheduled_times as _time
| sort + _time

[izzie123]

This worked for me, thanks. I was able to list out the searches by tweaking this query a little bit.

We see that there are many searches running in at the same time, any ideas on how we can tune this?

[richgalloway]

Manually reschedule searches so fewer of them run at the same time.