https://community.splunk.com/t5/Splunk-Search/How-do-I-list-valid-sids-for-a-loadjob-command-programmatically/m-p/270749#M81496 <P>Hi hylam,</P> <P>assuming your saved search is named <CODE>foo</CODE>...</P> <P><STRONG>How do I list them?</STRONG></P> <PRE><CODE> index=_audit savedsearch_name="foo" search_id='scheduler_*' </CODE></PRE> <P><STRONG>Can I run a subsearch to list them and pick the 5th one?</STRONG></P> <PRE><CODE> | loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time | head 5 | tail 1 | rename search_id AS search | eval search=replace(search, "\'","") ] </CODE></PRE> <P><STRONG>Can I run a subsearch to list them and pick a random one?</STRONG></P> <PRE><CODE>| loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time | eval random=random() | eval random=substr(random, 1, 1) | table search_id, random | dedup random | where random="7" | rename search_id AS search | eval search=replace(search, "\'","") | fields - random ] </CODE></PRE> <P>Some messy work around since <CODE>tail</CODE> and <CODE>head</CODE> don't like to use <CODE>$boo$</CODE> values <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Sun, 13 Dec 2015 20:34:50 GMT MuS 2015-12-13T20:34:50Z https://community.splunk.com/t5/Splunk-Search/How-do-I-list-valid-sids-for-a-loadjob-command-programmatically/m-p/270748#M81495 <PRE><CODE>| loadjob &lt;sid&gt; savedsearch="admin:search:test2" </CODE></PRE> <P>sids looks like the epoch time of the job start time. How do I list them? Can I run a subsearch to list them and pick the 5th one? Can I run a subsearch to list them and pick a random one?</P> Sat, 12 Dec 2015 10:19:45 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-list-valid-sids-for-a-loadjob-command-programmatically/m-p/270748#M81495 hylam 2015-12-12T10:19:45Z https://community.splunk.com/t5/Splunk-Search/How-do-I-list-valid-sids-for-a-loadjob-command-programmatically/m-p/270749#M81496 <P>Hi hylam,</P> <P>assuming your saved search is named <CODE>foo</CODE>...</P> <P><STRONG>How do I list them?</STRONG></P> <PRE><CODE> index=_audit savedsearch_name="foo" search_id='scheduler_*' </CODE></PRE> <P><STRONG>Can I run a subsearch to list them and pick the 5th one?</STRONG></P> <PRE><CODE> | loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time | head 5 | tail 1 | rename search_id AS search | eval search=replace(search, "\'","") ] </CODE></PRE> <P><STRONG>Can I run a subsearch to list them and pick a random one?</STRONG></P> <PRE><CODE>| loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time | eval random=random() | eval random=substr(random, 1, 1) | table search_id, random | dedup random | where random="7" | rename search_id AS search | eval search=replace(search, "\'","") | fields - random ] </CODE></PRE> <P>Some messy work around since <CODE>tail</CODE> and <CODE>head</CODE> don't like to use <CODE>$boo$</CODE> values <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Sun, 13 Dec 2015 20:34:50 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-list-valid-sids-for-a-loadjob-command-programmatically/m-p/270749#M81496 MuS 2015-12-13T20:34:50Z