Reporting

Feature request: Job Manager/loadjob - Display SID and Filter on Non-expired/Expired

Explorer

It would be helpful to make the SID more readily accessible. It is currently available only in the "Inspect Job" pop up windows. I regularly run somewhat long initial searches that I further winnow down, analyze, or extract data by reloading the initial dataset with | loadjob sid.xxxxxxx

If the SID were displayed as a colum in the Job Manager, that would greatly improve usability for frequent loadjob users. Additionally, having the SID displayed with the results of every ad hoc search would be helpful as well. However, displaying the SID with ad hoc search results should probably be controlled by a user setting where a user can chose to have the SID hidden or shown by default.

Additionally, there should be a filter for Expired/Non-expired in the Job Manager, in addition to the filters for App, Owner, and Status. This would help in finding datasets that are still available for loadjob.

0 Karma
1 Solution

Esteemed Legend

Just add | addinfo to your search and you will see the job ID in the info_sid field.

View solution in original post

Esteemed Legend

Just add | addinfo to your search and you will see the job ID in the info_sid field.

View solution in original post

Explorer

Thanks, I didn't know about addinfo. However addinfo adds three other columns that are not relevant -- I'd have to | fields - info_max_time info_min_time info_search_time in order to clean it up. I'll just keep using the job inspector for now.

0 Karma

Esteemed Legend

You can pass it invisibly through like this:

... | addinfo | rename info_* AS _info_*

Then you have the best of both worlds; you, as the admin/author know that the fields are then and you can access them with $result._info_sid$ but nobody else knows that they are there because they are invisible on the stats tab.

Motivator

I've seen you comment this multiple times, and I just want to thank you for mentioning such a cool "feature" that I never would have thought of otherwise.

Cheers,
Jacob

Esteemed Legend

Don't forget to UpVote.

Explorer

Thanks for the followup. The info in your comment make it much more usable. I still wish the devs would incorporate a better built-in display of SID's.

Esteemed Legend

Don't forget to UpVote.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!