All Apps and Add-ons

Getting SID (search ID) from search results

joydeep741
Path Finder

My scheduled job in Splunk DB connect app runs 3 times a day and pulls DB records to an Index.
say index=my_index

Is there a way I can get the Search Job ID associated with the scheduled job ?

So that I can see how many records were fetched each time the scheduled search ran

I want to see the results something like:
DATE SID COUNT
01/04/2019 101 223
01/04/2019 102 226
01/04/2019 103 227

Basically I want anything unique associated with the results.

0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

You can include | addinfo to your query which will add the time the search ran and the SID of that search.
https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Addinfo

View solution in original post

0 Karma

lakshman239
Influencer

You should be able to see them in 'sid' field in index=_internal source="*dbx2* " and then use source/sourcetype/fields to match your scheduled search

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

You can include | addinfo to your query which will add the time the search ran and the SID of that search.
https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Addinfo

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...