Splunk Search

What is the best way to get a scheduled saved search creation date?

pradeepkumarg
Influencer

I do not want to run through _audit logs to find when the initial schedule kicked in. Rest call for the list of saved searches gives me only the updated date which doesn't help much.

0 Karma

Zubbuz
Loves-to-Learn

@pradeepkumarg : Did you get the query to pull the creation time?

0 Karma

acharlieh
Influencer

Without looking at _audit or possibly access logs in _internal you're out of luck. And even that would potentially be an inexact science. Only one date, if that, is stored in default.meta / local.meta. All saved searches for an app are written to the same savedsearches.conf file (so file create date doesn't necessarily help in the general case either, unless it is the only saved search, and even then some other saved search could have been created first and later deleted.

If you have a compelling business case for it you could file a P4 for it. Alternatively if you can move toward a Splunk management model where everything is in source control and the only way to a scheduled search was through a deployment pipeline, ideally your configuration management tools could provide auditing that could be searchable on it's own or indexed by Splunk even (but that is quite the journey to get there)

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...