Splunk using rest api to fetch app name / id

[Dawson014]

Hello fellow Splunkers,

I am using the following query to fetch the splunk app name in standalone search head -

| rest /services/search/jobs splunk_server=local 
| addinfo 
| where sid = info_sid 
| rename eai:acl.app as app_name
| fields + app_name

However, this same query is not working in SHC. It shows No results found
Any suggestions would be appreciated.

Thanks!

[sdawsonkg · Accepted solution]

If you're running the query on a dashboard then this should work -

<your_base_query>
| eval app_name = $env:app$
| ...

However, this will not work if you are running the query on a search panel.

[Dawson014]

This will do. Thanks!

[sdawsonkg]

Good. Cheers!

[renjith_nair]

Hi @Dawson014,
Try running just | rest /services/search/jobs and see if it works

[Dawson014]

Tried this, worked once. Then again the same No Results founds