where are job manager search results stored

[jonathanfalconi]

Hi - Where are the job manager search results stored on the disk if I want to find it via CLI?

[Jason]

If you need to know where a particular search result is, use a REST search.

| rest splunk_server=local count=0 /services/search/jobs | rename title as searchString | rename label as searchName | table searchName searchString sid | search searchName="...etc"

This will get you a transposed (fields are now events) listing of the newest search job. 'sid' is the Search ID, and also the name of the folder in your dispatch directory.

[sowings]

Job results are stored in the dispatch directory on the search head: $SPLUNK_HOME/var/run/splunk/dispatch.

[splunker12er]

Location : dispatch directory
Default storage period : 7 days (later it will be deleted)

[sowings]

The SID should match the name of the directory in there. I just ran a search, used the job inspector to find the SID: 1380118161.133, and sure enough, there's a directory by that name in the dispatch directory. Any others you see in there with a longer form, such as: scheduler__nobody__SplunkforPaloAltoNetworks__RMD548bd043d4f751080_at\_1380118200_27537 represent scheduled jobs.

[jonathanfalconi]

Thanks - there are quite a few folders in dispatch dir, how can I work out where my particular job is? I do have the SID.