Splunk Search

Is there a way to get an event by some unique ID(s) ?

socalvin
New Member

I read this but this was almost two years ago:

http://splunk-base.splunk.com/answers/49/does-each-splunk-event-have-a-unique-identifier

Is there any way to retrieve a particular event with one or some of the fields returned from 'search/jobs/export'

Thanks

Calvin

Tags (1)
0 Karma

thisissplunk
Builder

Is this what you're asking for?

index=awesome sourcetype=woah
rename _cd as unique_id
| search unique_id=9320:49207386

0 Karma

pembleton
Path Finder

hey, i join on this question, any update?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...