Splunk Search

How to catch information from inspector job?

jip31
Motivator

Hi

I would like to catch the information in the example below:

This search has completed and has returned 1 000 résultat by scanning 2 610 582 événement in 220,758 seconds

These information comes from the job inspector.
How can I catch information and the response time?

Thanks a lot

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

You can access these details in _audit index. If you have access to _audit index then try to run search index=_audit search_id=* info=completed this will provide run time, event count, result count etc.

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

You can access these details in _audit index. If you have access to _audit index then try to run search index=_audit search_id=* info=completed this will provide run time, event count, result count etc.

0 Karma

jip31
Motivator

thanks a lot

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...