Reporting

How to get sid for particular job, when i try to get sid from this command, every time im getting different sid curl -k -u user:pass -d search="search index=cyberark_error_solution_kb" https://ctsc00782716701:8089/servicesNS/admin/search/search/jobs

673344
New Member

curl -k -u user:pass -d search="search index=cyberark_error_solution_kb" https://ctsc00782716701:8089/servicesNS/admin/search/search/jobs

Tags (2)
0 Karma

JDukeSplunk
Builder

You want the search sid, like in the URL? Like this? /en-US/app/search/search?q=search%20index%3Dtest&sid=1539111270.454955_197AB89D-D8CE-4CEE-BF99-1B35C805ED07

The sid is what Splunk uses to quickly pull up a result of a search without having to run it again. It's a job. Every time you run the same search without specifying the exact same time frame and search it will generate a new sid, since the search is different due to time from the last one. This would explain why you are getting different search sids when you run it.

Even if you specify the exact same time frame with earliest and latest in the search string, after a certain amount of time the job will expire and you will still get a new sid.

You might try to save and schedule the job and run the results link from the command line.

0 Karma

hhsu_splunk
Splunk Employee
Splunk Employee

Or you could add -d id=sid_name, this is in the document link.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...