Hi,
i want to find out the total run time of both ad-hoc and saved searches. I checked in _audit index to find out the total_run_time.. there i can find the total_Run_time for saved searches but i want to find the total run time for the ad-hoc search as well.
please help me to get the total_run_time.
The best way to do is to go to your "Monitoring console"
splunk_url/en-US/app/splunk_monitoring_console/search_usage_statistics_instance
There is a "Only Ad Hoc Searches" radio choice. You can put to "No"
Once you do this, there will be a small "search icon" coming up under that panel. You can click on that search icon to get the search query/SPL behind it if you need it.
The core part of search is something like
(search_id!="rsa_*" action=search index=_audit sourcetype=audittrail)
| stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id