Splunk Search

What is the best way to get a scheduled saved search creation date?

pradeepkumarg
Influencer

I do not want to run through _audit logs to find when the initial schedule kicked in. Rest call for the list of saved searches gives me only the updated date which doesn't help much.

0 Karma

Zubbuz
Loves-to-Learn

@pradeepkumarg : Did you get the query to pull the creation time?

0 Karma

acharlieh
Influencer

Without looking at _audit or possibly access logs in _internal you're out of luck. And even that would potentially be an inexact science. Only one date, if that, is stored in default.meta / local.meta. All saved searches for an app are written to the same savedsearches.conf file (so file create date doesn't necessarily help in the general case either, unless it is the only saved search, and even then some other saved search could have been created first and later deleted.

If you have a compelling business case for it you could file a P4 for it. Alternatively if you can move toward a Splunk management model where everything is in source control and the only way to a scheduled search was through a deployment pipeline, ideally your configuration management tools could provide auditing that could be searchable on it's own or indexed by Splunk even (but that is quite the journey to get there)

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...