RFE: capability to set expiration date for scheduled searches

[the_wolverine]

We have a lot of users that create scheduled searches and walk away (forget about them). We'd like the capability to set an expiration date on scheduled searches so that they automatically become either unscheduled or disabled on some date -- set at the time the search is configured.

Also would be nice to be able to set a default expiration date for all scheduled searches -- which can be overridden, of course.

[sowings]

The trouble I see with this is that the only place where you get an indication of when the search was created is in the local.meta. None of the eai: fields as returned by, say, | rest /services/saved/searches contain the time at which the search was authored. I might attack this from the filesystem, cruising through local.meta files.

[s2_splunk]

Hmmm, I seem to remember a related question a while ago that led me to look and it appears that local.meta only contains the last modification time. But that may be good enough.
How about indexing all metadata directories with a little (CRC) salt? That may be a good exercise in coming up with props/transforms for these... 😉 But then you could probably run a search that identifies all saved searches that are old (modtime) and haven't run in a while (index=_audit) and check with owners/delete.

[s2_splunk]

Is this a question? 😉
Or an enhancement request?