Knowledge Management

Add the search ID to my search results

forbushbl
Engager

Is it possible to add the search ID for the currently running search to the search results?

I have a report that populates a summary index and I have an alert running against the summary index which triggers a webhook. Here is the flow.

scheduled report --> summary index --> alert --> webhook

I would like to capture the search ID from the scheduled report somehow and store that in the summary index so that I could build a link back to the job results for the scheduled report. I figure if that if there is someway to access this ID in my search pipeline, I can just include it in my scheduled report and it will end up in the summary index.

Any help would be appreciated.

0 Karma
1 Solution

somesoni2
Revered Legend

You can include |addinfo command in your summary index search which gives info_sid field which contains current job SID. See more on addinfo command here:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Addinfo

View solution in original post

somesoni2
Revered Legend

You can include |addinfo command in your summary index search which gives info_sid field which contains current job SID. See more on addinfo command here:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Addinfo

forbushbl
Engager

This is exactly what I was looking for, thanks!

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...