Splunk Search

total concurrent searches

d646800
Explorer

can anyone let me know how to find the total concurrent searches in splunk for example in the last few days etc and the details of the search

i was doing this
index=_internal source=*metrics.log group="search_concurrency" host=A | timechart span=1m sum(active_hist_searches) as concurrent_searches by host

but i cannot see the type of searches or the search string etc in it. is there a way to find it out

Tags (1)
0 Karma

d646800
Explorer

thanks for the reply, I cannot seem to see sourcetype="searches" though i can see the sourcetype="scheduler".

0 Karma

chimbudp
Contributor

You could probably accomplish your goal, using Splunk internal information. The running jobs are normally tracked by Splunk as follows:

Saved Searches: index="_internal" sourcetype="scheduler" earliest=02/05/2011:12:20:00 latest=02/05/2011:12:25:00

Manual Searches: index="_internal" sourcetype="searches" earliest=02/05/2011:12:20:00 latest=02/05/2011:12:35:00

0 Karma

chimbudp
Contributor
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...