Reporting

How do you get a list of disabled saved searches and the time since when they were disabled?

JuhiSaxena
Explorer

We are using following query to report a list of disabled saved searches , however we want a time param to be appended in the table . Please advise.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search  disabled=1 is_scheduled=1 
| fields title eai:acl.owner eai:acl.app eai:acl.sharing 
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing
Tags (1)
0 Karma

damien_chillet
Builder

Since you are looking at searches that used to be scheduled I would suggest looking at last time it was run using the Splunk scheduler logs:

| rest splunk_server=local /servicesNS/-/-/saved/searches 
| search disabled=1 is_scheduled=1 
| fields title eai:acl.owner eai:acl.app eai:acl.sharing 
| join title type=left  [ search index=_internal sourcetype=scheduler | stats max(_time) as last_time by savedsearch_name | convert ctime(last_time) | rename savedsearch_name as title | fields title last_time]
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing last_time as "last time"

Note:
You won't be able to get last time it was run if it was longest time ago than the _internal index retention time.

0 Karma

JuhiSaxena
Explorer

Thank you for your response. However this query is flagging those searches as well which are Enabled [and not in disabled state].

0 Karma

damien_chillet
Builder

Are you sure about that?
If you add disabled to the list of fields, you should see that all the searches in the table have disabled set to 1.

0 Karma

JuhiSaxena
Explorer

ok , i can now see it working. Ill get back to you after playing around with the query. Thanks a lot again.

0 Karma

damien_chillet
Builder

Great, you welcome 🙂

0 Karma

JuhiSaxena
Explorer

Hi,
the time being picked is the scheduled time ie, when was the alert last scheduled to run. Is there any way to pick up the actual time when alert was disabled.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...