| rest /services/search/jobs Source?

[andrewkenth]

Is there a way to find the source of a job that ran? For instance is it on a dashboard or is it a preconfigured report and if so show the proper names of the items (report name, dashboard panel name)? It seems there is only a title (label) when it's run on the scheduler.

| rest /services/search/jobs

[somesoni2]

Try this: (just per my understanding, may need revision)

| rest /services/search/jobs | eval Job_type=if(delegate="scheduler","Scheduled","Adhoc")| rex field=id "(?<jobId>[^//]*)$"| rename eai:acl.app as App | eval searchType=case(isnum(jobId),"Regular Search", LIKE(jobId,"sch%"), "Scheduled Search",1=1,"Dashboard Search") | where searchType="Scheduled Search" | eval searchType=if(mvindex(split(jobId,"_"),5)==label AND isBatchModeSearch=1,"Scheduled Report", searchType) | table Job_type, App, label , searchType , updated