How to fetch fields and values reported in Job inspector of searches executed by end users?

[Taruchit]

Hello All,

I need help to make build an SPL which helps to get the results of Job inspector for each query executed by end users.

Example of fields: -

command.search.rawdata

command.search.kv

command.search.index

Any information or guidance will be very helpful.

Thank you

Taruchit

[richgalloway · Accepted solution]

The information in the Job Inspector is not indexed so it cannot be searched.

[Taruchit]

Hi @richgalloway,

Is there no repository or directory in Splunk that stores the results seen in Job inspector?

Like when we have scheduled searches, we can see job inspector and its data of atleast past two results. So, do we have any way to fetch that data via SPL, at least till TTL of those search does not expire?

Thank you

[richgalloway]

Search results are stored in the dispatch directory so they can be recalled later (until they expire).  That directory is not indexed, however, so it is not available via SPL.

You can monitor that directory if you wish, but it will use a LOT of your license quota.

[Taruchit]

Hi @richgalloway,

Thank you for sharing. 

Taruchit