topic Re: How do I display a list of PIDS for all searches running in my environment with a timerange of all-time? in All Apps and Add-ons

How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

jwoger_splunk — Tue, 03 Feb 2015 21:20:15 GMT

Re: How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

RicoSuave — Tue, 03 Feb 2015 21:22:34 GMT

Assuming you have the ps_sos script enabled in your environment from the SOS app, you can use the following search.

index=sos sourcetype=ps [search index=_audit action=search user=* (apiStartTime='ZERO_TIME' AND apiEndTime='ZERO_TIME') | rex field=_raw "search_id\=\'(?<scrubbedsearch>\w+\.\w+)" | eval ARGS="*" + scrubbedsearch + "*" | fields + ARGS] | fields + PID | DEDUP PID | table PID

This will give you the following output:

Re: How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

sowings — Fri, 13 Feb 2015 00:39:07 GMT

I was trying to do something with | rest /services/search/jobs, since it has PID and earliestTime, but for some reason my strptime call isn't parsing 1969-12-31T16:00:00-08:00 for me. Maybe somebody else can give that a whack.

Re: How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

ramdaspr — Fri, 13 Feb 2015 08:03:25 GMT

Splunk only processes time beyond the unix epoch event i.e. 1/1/1970 so 1969 and earlier wont work for you

Re: How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

sowings — Fri, 13 Feb 2015 21:01:36 GMT

While true, 1969-12-31 4pm Pacific time is the epoch (time = 0), so theoretically I should get 0 rather than null.

Re: How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

ramdaspr — Sat, 14 Feb 2015 00:11:06 GMT

Aah.. excellent point. I didn't parse the string before commenting..

Looks like a bug in that case, it seems to ignore the UTC offset in the calculation. You might want to add a tag for bug to see if someone can help.

I tried locally with the below code which should have worked but no dice..

| gentimes start=-1 | eval time="1970-01-01T10:00:00+1000" | eval timestamp=strptime(time,"%Y-%m-%dT%H:%M:%S%z") | eval timelocal=strftime(timestamp,"%Y-%m-%dT%H:%M:%S%z")| table time,timestamp,timelocal