How to get sid for particular job, when i try to get sid from this command, every time im getting different sid curl -k -u user:pass -d search="search index=cyberark_error_solution_kb" https://ctsc00782716701:8089/servicesNS/admin/search/search/jobs

[673344]

curl -k -u user:pass -d search="search index=cyberark_error_solution_kb" https://ctsc00782716701:8089/servicesNS/admin/search/search/jobs

[JDukeSplunk]

You want the search sid, like in the URL? Like this? /en-US/app/search/search?q=search%20index%3Dtest&sid=1539111270.454955_197AB89D-D8CE-4CEE-BF99-1B35C805ED07

The sid is what Splunk uses to quickly pull up a result of a search without having to run it again. It's a job. Every time you run the same search without specifying the exact same time frame and search it will generate a new sid, since the search is different due to time from the last one. This would explain why you are getting different search sids when you run it.

Even if you specify the exact same time frame with earliest and latest in the search string, after a certain amount of time the job will expire and you will still get a new sid.

You might try to save and schedule the job and run the results link from the command line.

[hhsu_splunk]

Or you could add -d id=sid_name, this is in the document link.