Splunk Search

one liner to get list of scheduled searches associated with users

sanju005ind
Communicator

How do I get a list of scheduled searches associated with user info.

Tags (1)
1 Solution

Genti
Splunk Employee
Splunk Employee

maybe this will do:

 index="_internal" source="*scheduler.log" savedsplunker | stats count BY user, savedsearch_name

Update:
I think there is either something you are missing, or perhaps you are not running any of the scheduled searches on the search head. I changed the search slightly to include the host as well as the savedsearch name and user. here is the search i used and my output:

index="_internal" source="*scheduler.log" savedsplunker | stats count BY user, savedsearch_name, host  

> user     savedsearch_name       host      count
> 1 admin    internal               bigmac    2
> 2 admin    testingsss             lilmac    4
> 3 nobody  Indexing workload      bigmac    245
> 4 nobody  Indexing workload      lilmac    1496
> 5 nobody  Top five sourcetypes   bigmac    245 
> 6 nobody  Topfive sourcetypes    lilmac    4501

note: Indexingworkload and TOP5Sourcetypes are the default scheduled savedsearches that come shipped with splunk. i just scheduled some more savedsearches, one on the indexer, one on the search head, and they both ran, and as you see, i see them both on my search results. lilmac=search head, bigmac=indexer.

Disclaimer: bigmac has got nothing to do with the "burger" 😉

View solution in original post

Genti
Splunk Employee
Splunk Employee

maybe this will do:

 index="_internal" source="*scheduler.log" savedsplunker | stats count BY user, savedsearch_name

Update:
I think there is either something you are missing, or perhaps you are not running any of the scheduled searches on the search head. I changed the search slightly to include the host as well as the savedsearch name and user. here is the search i used and my output:

index="_internal" source="*scheduler.log" savedsplunker | stats count BY user, savedsearch_name, host  

> user     savedsearch_name       host      count
> 1 admin    internal               bigmac    2
> 2 admin    testingsss             lilmac    4
> 3 nobody  Indexing workload      bigmac    245
> 4 nobody  Indexing workload      lilmac    1496
> 5 nobody  Top five sourcetypes   bigmac    245 
> 6 nobody  Topfive sourcetypes    lilmac    4501

note: Indexingworkload and TOP5Sourcetypes are the default scheduled savedsearches that come shipped with splunk. i just scheduled some more savedsearches, one on the indexer, one on the search head, and they both ran, and as you see, i see them both on my search results. lilmac=search head, bigmac=indexer.

Disclaimer: bigmac has got nothing to do with the "burger" 😉

Genti
Splunk Employee
Splunk Employee

I do not think that is an issue, see updated answer above

0 Karma

sanju005ind
Communicator

When I run this query on the search head it gives me all the users from the Distributed servers but not the savedsearches on the search head.

0 Karma

sanju005ind
Communicator

Thanks that was great.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...