Reporting

Feature request: Job Manager/loadjob - Display SID and Filter on Non-expired/Expired

collinrice
Explorer

It would be helpful to make the SID more readily accessible. It is currently available only in the "Inspect Job" pop up windows. I regularly run somewhat long initial searches that I further winnow down, analyze, or extract data by reloading the initial dataset with | loadjob sid.xxxxxxx

If the SID were displayed as a colum in the Job Manager, that would greatly improve usability for frequent loadjob users. Additionally, having the SID displayed with the results of every ad hoc search would be helpful as well. However, displaying the SID with ad hoc search results should probably be controlled by a user setting where a user can chose to have the SID hidden or shown by default.

Additionally, there should be a filter for Expired/Non-expired in the Job Manager, in addition to the filters for App, Owner, and Status. This would help in finding datasets that are still available for loadjob.

0 Karma
1 Solution

woodcock
Esteemed Legend

Just add | addinfo to your search and you will see the job ID in the info_sid field.

View solution in original post

woodcock
Esteemed Legend

Just add | addinfo to your search and you will see the job ID in the info_sid field.

collinrice
Explorer

Thanks, I didn't know about addinfo. However addinfo adds three other columns that are not relevant -- I'd have to | fields - info_max_time info_min_time info_search_time in order to clean it up. I'll just keep using the job inspector for now.

0 Karma

woodcock
Esteemed Legend

You can pass it invisibly through like this:

... | addinfo | rename info_* AS _info_*

Then you have the best of both worlds; you, as the admin/author know that the fields are then and you can access them with $result._info_sid$ but nobody else knows that they are there because they are invisible on the stats tab.

jacobpevans
Motivator

I've seen you comment this multiple times, and I just want to thank you for mentioning such a cool "feature" that I never would have thought of otherwise.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

woodcock
Esteemed Legend

Don't forget to UpVote.

collinrice
Explorer

Thanks for the followup. The info in your comment make it much more usable. I still wish the devs would incorporate a better built-in display of SID's.

woodcock
Esteemed Legend

Don't forget to UpVote.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...