All Apps and Add-ons

How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

Splunk Employee
Splunk Employee
1 Solution

Builder

Assuming you have the ps_sos script enabled in your environment from the SOS app, you can use the following search.

index=sos sourcetype=ps [search index=_audit action=search user=* (apiStartTime='ZERO_TIME' AND apiEndTime='ZERO_TIME') | rex field=_raw "search_id\=\'(?<scrubbedsearch>\w+\.\w+)" | eval ARGS="*" + scrubbedsearch + "*" | fields + ARGS] | fields + PID | DEDUP PID | table PID

This will give you the following output:

alt text

View solution in original post

Builder

Assuming you have the ps_sos script enabled in your environment from the SOS app, you can use the following search.

index=sos sourcetype=ps [search index=_audit action=search user=* (apiStartTime='ZERO_TIME' AND apiEndTime='ZERO_TIME') | rex field=_raw "search_id\=\'(?<scrubbedsearch>\w+\.\w+)" | eval ARGS="*" + scrubbedsearch + "*" | fields + ARGS] | fields + PID | DEDUP PID | table PID

This will give you the following output:

alt text

View solution in original post

Contributor

Splunk only processes time beyond the unix epoch event i.e. 1/1/1970 so 1969 and earlier wont work for you

0 Karma

Splunk Employee
Splunk Employee

While true, 1969-12-31 4pm Pacific time is the epoch (time = 0), so theoretically I should get 0 rather than null.

0 Karma

Contributor

Aah.. excellent point. I didn't parse the string before commenting..

Looks like a bug in that case, it seems to ignore the UTC offset in the calculation. You might want to add a tag for bug to see if someone can help.

I tried locally with the below code which should have worked but no dice..

| gentimes start=-1 | eval time="1970-01-01T10:00:00+1000" | eval timestamp=strptime(time,"%Y-%m-%dT%H:%M:%S%z") | eval timelocal=strftime(timestamp,"%Y-%m-%dT%H:%M:%S%z")| table time,timestamp,timelocal
0 Karma

Splunk Employee
Splunk Employee

I was trying to do something with | rest /services/search/jobs, since it has PID and earliestTime, but for some reason my strptime call isn't parsing 1969-12-31T16:00:00-08:00 for me. Maybe somebody else can give that a whack.

0 Karma