In 4.1, there is a job inspector available via the flashtimeline. In the "Actions" menu, choose "Inspect search..." to see all the details of the current job. This inspector is also linked from dashboard panels when there are no results displayed.
Really? Isn't this precisely that?
03-19-2010 14:09:33.277 INFO AuditLogger - Audit:[timestamp=03-19-2010 14:09:33.277, user=admin, action=search, info=granted , searchid="1269032973.28", search='search * | head 10', autojoin=1, buckets=300, ttl=600, maxcount=10000, maxtime=0, enablelookups=1, extrafields="*", apiStartTime="Thu Mar 18 14:00:00 2010", apiEndTime="Fri Mar 19 14:09:33 2010"][n/a]
One way to match up the job id to your search.
After running a search the artifacts should be kept on your filesystem under /var/run/splunk/dispatch// Under that dir a status.csv file should hold the actual search terms, along with "run time" and various other fields. The searches.log will show what the search is actually doing.
To check within splunk you could login to your management port via https https://
After you perform a recent search in your UI you should see the most recent job artifacts there, Not entirely positive this data matches what it's /var/run/splunk/dispatch
I was hoping a log in Splunk would reveal it. The web access log shows some of the search query, but its an HTTP post, so its all mangled with escaped characters.
Should i index those "status.csv" files?