Splunk Search

What is the best way to get a scheduled saved search creation date?


I do not want to run through _audit logs to find when the initial schedule kicked in. Rest call for the list of saved searches gives me only the updated date which doesn't help much.

0 Karma


Without looking at _audit or possibly access logs in _internal you're out of luck. And even that would potentially be an inexact science. Only one date, if that, is stored in default.meta / local.meta. All saved searches for an app are written to the same savedsearches.conf file (so file create date doesn't necessarily help in the general case either, unless it is the only saved search, and even then some other saved search could have been created first and later deleted.

If you have a compelling business case for it you could file a P4 for it. Alternatively if you can move toward a Splunk management model where everything is in source control and the only way to a scheduled search was through a deployment pipeline, ideally your configuration management tools could provide auditing that could be searchable on it's own or indexed by Splunk even (but that is quite the journey to get there)