| rest /servicesNS/-/-/saved/searches splunk_server=local |where disabled=0 AND is_scheduled=1 | rex field=cron_schedule "(?<Min>\S+)\s+(?<Hr>\S+)\s+(?<Day>\S+)\s+(?<Mon>\S+)\s+(?<Wday>\S+)" | table author eai:acl.app  title disabled is_scheduled  cron_schedule Min Hr Day Mon Wday search | rename eai:acl.app as appName title as searchName
| eval searchType=case(cron_schedule="* * * * *", "Running Every Minute", 
        (Hr="*" AND Day="*" AND Mon="*" AND Wday="*" ) AND (Min="*/5"), "Running Every 5 Minute", 
        (Hr="*" AND Day="*" AND Mon="*" AND Wday="*" ) AND (Min="*/10"), "Running Every 10 Minute", 
        (Hr="*" AND Day="*" AND Mon="*" AND Wday="*" ) AND (Min="*/15"), "Running Every 15 Minute", 
        (Hr="*" AND Day="*" AND Mon="*" AND Wday="*" ) AND (Min="*/20"), "Running Every 20 Minute", 
        (Hr="*" AND Day="*" AND Mon="*" AND Wday="*" ) AND (Min="*/30"), "Running Every 30 Minute", 
       (Hr="*" AND Day="*" AND Mon="*" AND Wday="*" ) AND (Min="*/30"), "On the hour", 
         match(cron_schedule,"^(\d+,\d+)+ \* \* \* \*$"), "Running Multiple times every hour", 
         match(cron_schedule,"^\d+ \* \* \* \*$"), "Running Every Hour", 
         match(cron_schedule,"^\d+ \d+ \* \* \*$"), "Running Daily",true(),"Other")
| search searchType="Running Every Hour"