Splunk Search

how to find the total time taken by a search to finish the run for both adhoc and saved searches

manjuase
Explorer

Hi,
i want to find out the total run time of both ad-hoc and saved searches. I checked in _audit index to find out the total_run_time.. there i can find the total_Run_time for saved searches but i want to find the total run time for the ad-hoc search as well.

please help me to get the total_run_time.

0 Karma

koshyk
Super Champion

The best way to do is to go to your "Monitoring console"
splunk_url/en-US/app/splunk_monitoring_console/search_usage_statistics_instance

There is a "Only Ad Hoc Searches" radio choice. You can put to "No"
Once you do this, there will be a small "search icon" coming up under that panel. You can click on that search icon to get the search query/SPL behind it if you need it.

The core part of search is something like

(search_id!="rsa_*" action=search  index=_audit sourcetype=audittrail) 
| stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...