Splunk Search

How can I get the job id from Splunk?

Palrav12
New Member

I need job id from Splunk. How to get the job id from Splunk? I execute the curl command but I didn't get the Job id , please help me out how to get it.

0 Karma

emeelan_splunk
Splunk Employee
Splunk Employee

My assumption is that you want to run a search in the UI then grab the results through our API; is that correct?

There are two ways to find the search ID (SID) of a job. One is to go to the search in the Splunk UI, click Job > Inspect Job. The Search job inspector will show you the SID in parenthesis.

You can also return the SID of various search jobs via API by using the POST command with the following call: https://host:mPort/services/search/jobs. The "host" and "mport" fields are place holders for your personal info.

You can view more info here: http://docs.splunk.com/Documentation/Splunk/6.6.3/RESTREF/RESTsearch#search.2Fjobs for this endpoint. If you expand the POST window, you can view all of the parameters available, but you shouldn’t need any of them unless you want to limit the number of searches, the timeframe, etc… Note, however, that if you choose not to use any parameters, I think all searches are returned, and that might take a really long time.

At the bottom of the expanded window, you can view various API calls that make use of the SID returned by the endpoint above. For example, to view the status of a job, you would call:

search/jobs/{search_id}

Where {search_id} is the SID returned by your original call (or copied from the Search job inspector in the UI).

I hope this answers your question.

Thanks,
Eve

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @palrav12, I saw this similar post.
The answer is for an older version of Splunk, but I found this newer version

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!