Knowledge Management

Add the search ID to my search results

forbushbl
Engager

Is it possible to add the search ID for the currently running search to the search results?

I have a report that populates a summary index and I have an alert running against the summary index which triggers a webhook. Here is the flow.

scheduled report --> summary index --> alert --> webhook

I would like to capture the search ID from the scheduled report somehow and store that in the summary index so that I could build a link back to the job results for the scheduled report. I figure if that if there is someway to access this ID in my search pipeline, I can just include it in my scheduled report and it will end up in the summary index.

Any help would be appreciated.

0 Karma
1 Solution

somesoni2
Revered Legend

You can include |addinfo command in your summary index search which gives info_sid field which contains current job SID. See more on addinfo command here:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Addinfo

View solution in original post

somesoni2
Revered Legend

You can include |addinfo command in your summary index search which gives info_sid field which contains current job SID. See more on addinfo command here:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Addinfo

forbushbl
Engager

This is exactly what I was looking for, thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...