Splunk Search

How to get the real time status of a job?


I am trying to get the current status of a job that is running now from the logs.

Suppose there are job events like STARTED, RUNNING, FAILURE, SUCCESS.

Based on a transaction, I need to find out the Jobs which have STARTED, but did not complete (still in running state).

So, if I have one job which has changed the status from running to success, this job should not come in the events. Only if it is in running status and has not succeeded , only then I should see the result in splunk events.

0 Karma


Do you have a unique ID for each job that runs? If so - try something like this:
index=yourIndex [search index=yourIndex status="STARTED" | fields yourUniqueIDField] | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS"
This should give you data for everything that has Started, but where there is not a FAILURE or SUCCESS log line.
You might actually find you dont need the subsearch, the following might also work:
index=yourIndex status=* | transaction yourUniqueIDField | search status!="FAILURE" status!="SUCCESS"
I hope this helps!

0 Karma


What do u mean by unique ID . I can say each job names are different . Can I consider that as unique id ? and what does transaction do in splunk?
And also I ant the real time transactions, suppose the log I have appends each run for a job . In that case a job will generate a log having all the transaction status : eg. started, running, success or failure.
Ur search is giving me results for all the jobs that has one time went into running status which is not what I need.
I need only those jobs which are at present in running status and has not succeeded or failed.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...