hi,
Can anyone please help me with a search to to identify scheduled jobs for abc and xyz application and the user owning that job? i know i need to use index=_internal and source=scheduler.log
. But i am not getting the exact requirement that i need.
Check this,
check the below query
| rest /services/saved/searches | where is_scheduled=1
for historical scheduled searches use the below query,
index=_internal sourcetype=scheduler | table _time user savedsearch_name status scheduled_time run_time result_count *