Splunk Search

What is the best way to get a scheduled saved search creation date?

pradeepkumarg
Influencer

I do not want to run through _audit logs to find when the initial schedule kicked in. Rest call for the list of saved searches gives me only the updated date which doesn't help much.

0 Karma

Zubbuz
Loves-to-Learn

@pradeepkumarg : Did you get the query to pull the creation time?

0 Karma

acharlieh
Influencer

Without looking at _audit or possibly access logs in _internal you're out of luck. And even that would potentially be an inexact science. Only one date, if that, is stored in default.meta / local.meta. All saved searches for an app are written to the same savedsearches.conf file (so file create date doesn't necessarily help in the general case either, unless it is the only saved search, and even then some other saved search could have been created first and later deleted.

If you have a compelling business case for it you could file a P4 for it. Alternatively if you can move toward a Splunk management model where everything is in source control and the only way to a scheduled search was through a deployment pipeline, ideally your configuration management tools could provide auditing that could be searchable on it's own or indexed by Splunk even (but that is quite the journey to get there)

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...