Splunk Search

how to find the total time taken by a search to finish the run for both adhoc and saved searches


i want to find out the total run time of both ad-hoc and saved searches. I checked in _audit index to find out the total_run_time.. there i can find the total_Run_time for saved searches but i want to find the total run time for the ad-hoc search as well.

please help me to get the total_run_time.

0 Karma

Super Champion

The best way to do is to go to your "Monitoring console"

There is a "Only Ad Hoc Searches" radio choice. You can put to "No"
Once you do this, there will be a small "search icon" coming up under that panel. You can click on that search icon to get the search query/SPL behind it if you need it.

The core part of search is something like

(search_id!="rsa_*" action=search  index=_audit sourcetype=audittrail) 
| stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...