It would be helpful to make the SID more readily accessible. It is currently available only in the "Inspect Job" pop up windows. I regularly run somewhat long initial searches that I further winnow down, analyze, or extract data by reloading the initial dataset with | loadjob sid.xxxxxxx
If the SID were displayed as a colum in the Job Manager, that would greatly improve usability for frequent loadjob
users. Additionally, having the SID displayed with the results of every ad hoc search would be helpful as well. However, displaying the SID with ad hoc search results should probably be controlled by a user setting where a user can chose to have the SID hidden or shown by default.
Additionally, there should be a filter for Expired/Non-expired in the Job Manager, in addition to the filters for App, Owner, and Status. This would help in finding datasets that are still available for loadjob
.
Just add | addinfo
to your search and you will see the job ID in the info_sid
field.
Just add | addinfo
to your search and you will see the job ID in the info_sid
field.
Thanks, I didn't know about addinfo
. However addinfo
adds three other columns that are not relevant -- I'd have to | fields - info_max_time info_min_time info_search_time
in order to clean it up. I'll just keep using the job inspector for now.
You can pass it invisibly through like this:
... | addinfo | rename info_* AS _info_*
Then you have the best of both worlds; you, as the admin/author know that the fields are then and you can access them with $result._info_sid$
but nobody else knows that they are there because they are invisible on the stats
tab.
I've seen you comment this multiple times, and I just want to thank you for mentioning such a cool "feature" that I never would have thought of otherwise.
Don't forget to UpVote
.
Thanks for the followup. The info in your comment make it much more usable. I still wish the devs would incorporate a better built-in display of SID's.
Don't forget to UpVote
.