Splunk Search

How can find out what search query was executed for a particular search job id?

Splunk Employee
Splunk Employee

I'm trying to map search performance to specific searches. I have to discover if its possible to marry up a job ID to the search that was executed. Any idea where to start?

Tags (2)

Contributor

In 4.1, there is a job inspector available via the flashtimeline. In the "Actions" menu, choose "Inspect search..." to see all the details of the current job. This inspector is also linked from dashboard panels when there are no results displayed.

Splunk Employee
Splunk Employee

I'd like to see that in a log as well.

0 Karma

Splunk Employee
Splunk Employee

The splunk audit.log should map search requests to job ids, which is available in (correction) the audit index.

Splunk Employee
Splunk Employee

Really? Isn't this precisely that?

03-19-2010 14:09:33.277 INFO AuditLogger - Audit:[timestamp=03-19-2010 14:09:33.277, user=admin, action=search, info=granted , searchid="1269032973.28", search='search * | head 10', autojoin=1, buckets=300, ttl=600, maxcount=10000, maxtime=0, enablelookups=1, extrafields="*", apiStartTime="Thu Mar 18 14:00:00 2010", apiEndTime="Fri Mar 19 14:09:33 2010"][n/a]

0 Karma

Splunk Employee
Splunk Employee

Splunk's logs do not contain the search query text related to a job id

0 Karma

Splunk Employee
Splunk Employee

One way to match up the job id to your search.

After running a search the artifacts should be kept on your filesystem under /var/run/splunk/dispatch// Under that dir a status.csv file should hold the actual search terms, along with "run time" and various other fields. The searches.log will show what the search is actually doing.

0 Karma

Splunk Employee
Splunk Employee

To check within splunk you could login to your management port via https https://:8089/services/search/jobs/

After you perform a recent search in your UI you should see the most recent job artifacts there, Not entirely positive this data matches what it's /var/run/splunk/dispatch

0 Karma

Splunk Employee
Splunk Employee

I was hoping a log in Splunk would reveal it. The web access log shows some of the search query, but its an HTTP post, so its all mangled with escaped characters.

Should i index those "status.csv" files?

0 Karma