Actually, some scheduled searches are taking lot of CPU usage, I want to know if they are used in dashboards or used for the purpose of alerting, so that if they are used for dashboards, i could decrease the frequency of those searches.
Thanks
Check if the scheduled searches
have any of these features:
SPL commands `sendemail` OR `outputlookup` (and possibly others like service now ones that start with `snow*`, depending on what apps you have installed and what custom commands they create and what those commands do)
Alert actions of any kind.
Referenced inside of other SPL (dahsboards, panels, reports, or saved searches) through `| loadjob` or `| savedsearch`.
Hi muizash,
usually scheduled searches aren't used in dashboards but only in alerts and to populate lookups or summaries or reports to use in dashboards.
To understand if you can modify frequency of your scheduled searches, you should at first point the the heaviest ones and see their own scope (alert, lookup, summary or report).
So you can choose if the frequency is correct or not:
Ciao.
Giuseppe
This search will list the scheduled searches with the scheduled time, and status. From here you can see if the scheduled is getting used anywhere or not
index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") | table sched status savedsearch_name
Then you can use below to list all the scheduled searches and then compare the results
| rest /services/saved/searches search="is_scheduled=1"