Sorry but that's all the tricks I know, not sure if there is something on the backend that can override it. Any of these recommendations I have sent have worked in my environment, but I'm not an admin so unsure of the backend wizardry. Good luck ... View more

Does this work for you? | eval _time=strftime(_time,"%F %H:%M:%S.%3Q") ... View more

My bad forgot to escape the double quotes for splunk. the section in the square brackets with catch a-zA-Z0-9 backslash and forward slash. If there are other characters $,%,- etc.. in the field they will need added | rex field=_raw "\"run\.name\":\"(?<RunName>[\w\\\\/\s]+)\","   ... View more

Is your visualisation 'Events' or 'Stats Table'? Should work for Stats table view but if that view doesn't work for you then you could cheat a little. | eval _time = modification_time  OR You can play with the time formatting with eval strptime (convert to unixtime) and feed that to strftime (format it the way you want) , but it may be more hassle then its worth. https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Commontimeformatvariables ... View more

you can use the table command to choose the fields to display | table creation_time, modification_time etc. ... View more

This should do the trick, thi | rex field=_raw "run\.name":"(?<RunName>[\w\s.]+)" The named capture group doesn't like the  space but you can use the "| rename RunName AS "Run Name" " http://regex101.com is where I do most of my testing   ... View more

Just tested and its slightly slower to submit a search and stream the results instead of querying the API $body = @{search = '|rest /services/search/jobs/1597138394.9683341 |fields sid, author, dispatchState, ttl, search, title, is*, resultcount | table sid, author, dispatchState, ttl, search, title, is*, resultcount'} $url = 'https://{0}:8089/services/search/jobs/export' Invoke-RestMethod -Uri $url -Method POST -Credential $stdcred -Body $body 1.2 Seconds Vs. $url=  'https://{0}:8089/services/search/jobs' Invoke-RestMethod -Uri "$url/$searchsid" -Method GET -Credential $stdcred Invoke-RestMethod -Uri "$searchURI/$searchsid" -Method GET -Credential $stdcred -erroraction .7 seconds  50% of the way through my searches so these times fluctuate based on the return from the subsearch <1second to >5seconds ... View more

That works when running the query from splunk to limit the data viewed, but the search itself takes several seconds. I could submit a new search and stream the results, will test how this performs vs. what I have currently What I am aiming to do is to write a powershell module using the rest API, so I want to be able to run get-splunksearch this will return the sid, owner, expiry date, runtime and status. This is working but just seems very slow due to the amount of data that the jobs endpoint returns. Code is very simple    $body = @{                     search = ('sid={0}' -f $searchSid)                 } Invoke-RestMethod -Uri https://servername:8089/services/search/jobs -Method GET -Credential $Credential -Body $body -erroraction stop same as curl https://localhost:8089/services/search/jobs --get -d sid=123454678.123456   I was hoping there would be a way to get the API to do the equivalent of  | table published id pid phase* dispatchState diskUsage search priority runDuration result* * ... View more

It's not the search that I am looking to update its the job details you get back through the API, if you look at the job inspector you can see the components litsearch, phase0 and phase1. When running a subsearch these can become very large, basically querying the API to see if the job is running/done/paused etc. and who created it. Working on submitting 200+ searches but it can take 5-6 seconds to get the job details back to know if it has completed. When you have 200 jobs that 5 seconds builds up ... View more