Reporting

Feature request: Job Manager/loadjob - Display SID and Filter on Non-expired/Expired

collinrice
Explorer

It would be helpful to make the SID more readily accessible. It is currently available only in the "Inspect Job" pop up windows. I regularly run somewhat long initial searches that I further winnow down, analyze, or extract data by reloading the initial dataset with | loadjob sid.xxxxxxx

If the SID were displayed as a colum in the Job Manager, that would greatly improve usability for frequent loadjob users. Additionally, having the SID displayed with the results of every ad hoc search would be helpful as well. However, displaying the SID with ad hoc search results should probably be controlled by a user setting where a user can chose to have the SID hidden or shown by default.

Additionally, there should be a filter for Expired/Non-expired in the Job Manager, in addition to the filters for App, Owner, and Status. This would help in finding datasets that are still available for loadjob.

0 Karma
1 Solution

woodcock
Esteemed Legend

Just add | addinfo to your search and you will see the job ID in the info_sid field.

View solution in original post

woodcock
Esteemed Legend

Just add | addinfo to your search and you will see the job ID in the info_sid field.

collinrice
Explorer

Thanks, I didn't know about addinfo. However addinfo adds three other columns that are not relevant -- I'd have to | fields - info_max_time info_min_time info_search_time in order to clean it up. I'll just keep using the job inspector for now.

0 Karma

woodcock
Esteemed Legend

You can pass it invisibly through like this:

... | addinfo | rename info_* AS _info_*

Then you have the best of both worlds; you, as the admin/author know that the fields are then and you can access them with $result._info_sid$ but nobody else knows that they are there because they are invisible on the stats tab.

jacobpevans
Motivator

I've seen you comment this multiple times, and I just want to thank you for mentioning such a cool "feature" that I never would have thought of otherwise.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

woodcock
Esteemed Legend

Don't forget to UpVote.

collinrice
Explorer

Thanks for the followup. The info in your comment make it much more usable. I still wish the devs would incorporate a better built-in display of SID's.

woodcock
Esteemed Legend

Don't forget to UpVote.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...