Reporting

RFE: capability to set expiration date for scheduled searches

the_wolverine
Champion

We have a lot of users that create scheduled searches and walk away (forget about them). We'd like the capability to set an expiration date on scheduled searches so that they automatically become either unscheduled or disabled on some date -- set at the time the search is configured.

Also would be nice to be able to set a default expiration date for all scheduled searches -- which can be overridden, of course.

0 Karma

sowings
Splunk Employee
Splunk Employee

The trouble I see with this is that the only place where you get an indication of when the search was created is in the local.meta. None of the eai: fields as returned by, say, | rest /services/saved/searches contain the time at which the search was authored. I might attack this from the filesystem, cruising through local.meta files.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Hmmm, I seem to remember a related question a while ago that led me to look and it appears that local.meta only contains the last modification time. But that may be good enough.
How about indexing all metadata directories with a little (CRC) salt? That may be a good exercise in coming up with props/transforms for these... 😉 But then you could probably run a search that identifies all saved searches that are old (modtime) and haven't run in a while (index=_audit) and check with owners/delete.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Is this a question? 😉
Or an enhancement request?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...