How can find out what search query was executed for a particular search job id?

[Michael_Wilde]

I'm trying to map search performance to specific searches. I have to discover if its possible to marry up a job ID to the search that was executed. Any idea where to start?

[Johnvey]

In 4.1, there is a job inspector available via the flashtimeline. In the "Actions" menu, choose "Inspect search..." to see all the details of the current job. This inspector is also linked from dashboard panels when there are no results displayed.

[Michael_Wilde]

I'd like to see that in a log as well.

[jrodman]

The splunk audit.log should map search requests to job ids, which is available in (correction) the audit index.

[jrodman]

Really? Isn't this precisely that?

03-19-2010 14:09:33.277 INFO AuditLogger - Audit:[timestamp=03-19-2010 14:09:33.277, user=admin, action=search, info=granted , search_id="1269032973.28", search='search * | head 10', autojoin=1, buckets=300, ttl=600, max_count=10000, maxtime=0, enable_lookups=1, extra_fields="*", apiStartTime="Thu Mar 18 14:00:00 2010", apiEndTime="Fri Mar 19 14:09:33 2010"][n/a]

[Michael_Wilde]

Splunk's logs do not contain the search query text related to a job id

[Chris_R_]

One way to match up the job id to your search.

After running a search the artifacts should be kept on your filesystem under /var/run/splunk/dispatch// Under that dir a status.csv file should hold the actual search terms, along with "run time" and various other fields. The searches.log will show what the search is actually doing.

[Chris_R_]

To check within splunk you could login to your management port via https https://:8089/services/search/jobs/

After you perform a recent search in your UI you should see the most recent job artifacts there, Not entirely positive this data matches what it's /var/run/splunk/dispatch

[Michael_Wilde]

I was hoping a log in Splunk would reveal it. The web access log shows some of the search query, but its an HTTP post, so its all mangled with escaped characters.

Should i index those "status.csv" files?