https://community.splunk.com/t5/Getting-Data-In/rest-services-search-jobs-Source/m-p/138579#M28470 <P>Is there a way to find the source of a job that ran? For instance is it on a dashboard or is it a preconfigured report and if so show the proper names of the items (report name, dashboard panel name)? It seems there is only a title (label) when it's run on the scheduler.</P> <PRE><CODE>| rest /services/search/jobs </CODE></PRE> Wed, 05 Feb 2014 17:27:23 GMT andrewkenth 2014-02-05T17:27:23Z https://community.splunk.com/t5/Getting-Data-In/rest-services-search-jobs-Source/m-p/138579#M28470 <P>Is there a way to find the source of a job that ran? For instance is it on a dashboard or is it a preconfigured report and if so show the proper names of the items (report name, dashboard panel name)? It seems there is only a title (label) when it's run on the scheduler.</P> <PRE><CODE>| rest /services/search/jobs </CODE></PRE> Wed, 05 Feb 2014 17:27:23 GMT https://community.splunk.com/t5/Getting-Data-In/rest-services-search-jobs-Source/m-p/138579#M28470 andrewkenth 2014-02-05T17:27:23Z https://community.splunk.com/t5/Getting-Data-In/rest-services-search-jobs-Source/m-p/138580#M28471 <P>Try this: (just per my understanding, may need revision)</P> <PRE><CODE>| rest /services/search/jobs | eval Job_type=if(delegate="scheduler","Scheduled","Adhoc")| rex field=id "(?&lt;jobId&gt;[^//]*)$"| rename eai:acl.app as App | eval searchType=case(isnum(jobId),"Regular Search", LIKE(jobId,"sch%"), "Scheduled Search",1=1,"Dashboard Search") | where searchType="Scheduled Search" | eval searchType=if(mvindex(split(jobId,"_"),5)==label AND isBatchModeSearch=1,"Scheduled Report", searchType) | table Job_type, App, label , searchType , updated </CODE></PRE> Wed, 05 Feb 2014 20:18:46 GMT https://community.splunk.com/t5/Getting-Data-In/rest-services-search-jobs-Source/m-p/138580#M28471 somesoni2 2014-02-05T20:18:46Z