Splunk Search

How do I list valid sids for a loadjob command programmatically/by subsearch?

hylam
Contributor
| loadjob <sid> savedsearch="admin:search:test2"

sids looks like the epoch time of the job start time. How do I list them? Can I run a subsearch to list them and pick the 5th one? Can I run a subsearch to list them and pick a random one?

Tags (3)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi hylam,

assuming your saved search is named foo...

How do I list them?

 index=_audit savedsearch_name="foo" search_id='scheduler_*' 

Can I run a subsearch to list them and pick the 5th one?

 | loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time | head 5 | tail 1 | rename search_id AS search | eval search=replace(search, "\'","")  ]

Can I run a subsearch to list them and pick a random one?

| loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time  |  eval random=random() | eval random=substr(random, 1, 1) | table search_id, random | dedup random | where random="7" | rename search_id AS search | eval search=replace(search, "\'","") | fields - random ]

Some messy work around since tail and head don't like to use $boo$ values 😉

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi hylam,

assuming your saved search is named foo...

How do I list them?

 index=_audit savedsearch_name="foo" search_id='scheduler_*' 

Can I run a subsearch to list them and pick the 5th one?

 | loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time | head 5 | tail 1 | rename search_id AS search | eval search=replace(search, "\'","")  ]

Can I run a subsearch to list them and pick a random one?

| loadjob [ search index=_audit savedsearch_name="foo" search_id='scheduler_*' | fields _time, search_id | sort - _time  |  eval random=random() | eval random=substr(random, 1, 1) | table search_id, random | dedup random | where random="7" | rename search_id AS search | eval search=replace(search, "\'","") | fields - random ]

Some messy work around since tail and head don't like to use $boo$ values 😉

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...