How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

[RicoSuave · Accepted solution]

Assuming you have the ps_sos script enabled in your environment from the SOS app, you can use the following search.

index=sos sourcetype=ps [search index=_audit action=search user=* (apiStartTime='ZERO_TIME' AND apiEndTime='ZERO_TIME') | rex field=_raw "search_id\=\'(?<scrubbedsearch>\w+\.\w+)" | eval ARGS="*" + scrubbedsearch + "*" | fields + ARGS] | fields + PID | DEDUP PID | table PID

This will give you the following output:

[ramdaspr]

Splunk only processes time beyond the unix epoch event i.e. 1/1/1970 so 1969 and earlier wont work for you

[sowings]

While true, 1969-12-31 4pm Pacific time is the epoch (time = 0), so theoretically I should get 0 rather than null.

[ramdaspr]

Aah.. excellent point. I didn't parse the string before commenting..

Looks like a bug in that case, it seems to ignore the UTC offset in the calculation. You might want to add a tag for bug to see if someone can help.

I tried locally with the below code which should have worked but no dice..

| gentimes start=-1 | eval time="1970-01-01T10:00:00+1000" | eval timestamp=strptime(time,"%Y-%m-%dT%H:%M:%S%z") | eval timelocal=strftime(timestamp,"%Y-%m-%dT%H:%M:%S%z")| table time,timestamp,timelocal

[sowings]

I was trying to do something with | rest /services/search/jobs, since it has PID and earliestTime, but for some reason my strptime call isn't parsing 1969-12-31T16:00:00-08:00 for me. Maybe somebody else can give that a whack.