Is there a way to get list of scheduled report and get the following:
1) when report was last ran,
2) display number of rows returned per report?
Try this
* index=_internal sourcetype=scheduler savedsearch_id=* status=* | timechart span=5m count by status
* index=_internal sourcetype=scheduler savedsearch_id=* status=* | stats count by reason
* index=_internal sourcetype=scheduler savedsearch_name=* status=success |stats count by savedsearch_name, scheduled_time | search count>1
Do you want list of all scheduled reports (and alerts) or just the one which are currently active?
@spammenot66,
Try
index=_internal source="*scheduler.log" savedsearch_id=*
index=_internal sourcetype=scheduler status=success | table _time savedsearch_name result_count