How do I find the name of a scheduled search just from the RMD5?

[Jason]

I see an entry in ps, or the internal logs, that has an instance of a scheduled search in it. It has this "RMD5" - how do I translate this to a saved search name?

[splunkd pid=2741] search --id=remote_svr-01_scheduler__nobody_U3BsdTQ__RMD5fe569a56999fe444_at_1412233580_5373 --maxbuckets=0 --ttl=60 --maxout=0 --maxtime=0 --lookups=1 --streaming --outCsv=true --user=splunk-system-user --pro --roles=admin:power:splunk-system-role:user

[Jason · Accepted solution]

The "RMD5" value is the right-hand side (right-hand 16 characters) of the MD5 of the search name.

To find out which search has this RMD5, run this search:

index=_internal sourcetype=scheduler sid="*RMD5.....*" | head 1 | table savedsearch_name