Hi, I am currently using the search below to get the status of my saved searches.
index=_internal sourcetype=scheduler | eval dispatch_time=strftime(dispatch_time, "%B %d %H:%M:%S") | table savedsearch_name status dispatch_time run_time result_count | sort dispatch_time
However, I want to see the following status:
Any suggestions? Thanks!
I think your search command is trying to get the status from the scheduler.log.
In scheduler.log, I don’t think it has the ‘running' status. In general, you could take status = success As 'completed' , other than success, you could take it as ‘not completed’.
Why not use the REST API?
| rest/servicesNS/-/-/saved/searches
by "not running" are you referring to saved searches that are not on a schedule? otherwise, in my opinion, if they are "not running" they would be "completed". I've never seen a "running" status, but I suppose i've never looked while i had a search running before.