Splunk Search

How to get List of realtime searches and the macro/savedSearch that runs on it

paramagurukarth
Builder

I am new to splunk...
How to get List of realtime searches and the macro/savedSearch that runs on it?
Is there any splunk query command or index from which i can get required information..

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi paramagurukarthikeyan,

try this from the search bar:

| rest /services/search/jobs | search eventSorting=realtime

cheers, MuS

View solution in original post

jpapp
New Member
| rest /servicesNS/-/-/search/jobs splunk_server=local | search eventSorting=realtime 

Works for me in Splunk 6.5

| rest /servicesNS/-/-/search/jobs | search eventSorting=realtime

Works for me on Splunk 6.5

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi paramagurukarthikeyan,

try this from the search bar:

| rest /services/search/jobs | search eventSorting=realtime

cheers, MuS

phoenixdigital
Builder

Anyone know how to do this on the latest version of Splunk 6.x?

This doesn't appear to work anymore.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi @phoenixdigital, what exactly are you after? The REST call still works in 6.4.1

0 Karma

phoenixdigital
Builder

I was trying to get a list of all saved searches that would use a realtime search.

Maybe because I am using a clustered search head the results are not consistent.

0 Karma

paramagurukarth
Builder

Thank you Michael... This is what i was looking for 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...