All Apps and Add-ons

How do I display a list of PIDS for all searches running in my environment with a timerange of all-time?

jwoger_splunk
Splunk Employee
Splunk Employee
1 Solution

RicoSuave
Builder

Assuming you have the ps_sos script enabled in your environment from the SOS app, you can use the following search.

index=sos sourcetype=ps [search index=_audit action=search user=* (apiStartTime='ZERO_TIME' AND apiEndTime='ZERO_TIME') | rex field=_raw "search_id\=\'(?<scrubbedsearch>\w+\.\w+)" | eval ARGS="*" + scrubbedsearch + "*" | fields + ARGS] | fields + PID | DEDUP PID | table PID

This will give you the following output:

alt text

View solution in original post

RicoSuave
Builder

Assuming you have the ps_sos script enabled in your environment from the SOS app, you can use the following search.

index=sos sourcetype=ps [search index=_audit action=search user=* (apiStartTime='ZERO_TIME' AND apiEndTime='ZERO_TIME') | rex field=_raw "search_id\=\'(?<scrubbedsearch>\w+\.\w+)" | eval ARGS="*" + scrubbedsearch + "*" | fields + ARGS] | fields + PID | DEDUP PID | table PID

This will give you the following output:

alt text

ramdaspr
Contributor

Splunk only processes time beyond the unix epoch event i.e. 1/1/1970 so 1969 and earlier wont work for you

0 Karma

sowings
Splunk Employee
Splunk Employee

While true, 1969-12-31 4pm Pacific time is the epoch (time = 0), so theoretically I should get 0 rather than null.

0 Karma

ramdaspr
Contributor

Aah.. excellent point. I didn't parse the string before commenting..

Looks like a bug in that case, it seems to ignore the UTC offset in the calculation. You might want to add a tag for bug to see if someone can help.

I tried locally with the below code which should have worked but no dice..

| gentimes start=-1 | eval time="1970-01-01T10:00:00+1000" | eval timestamp=strptime(time,"%Y-%m-%dT%H:%M:%S%z") | eval timelocal=strftime(timestamp,"%Y-%m-%dT%H:%M:%S%z")| table time,timestamp,timelocal
0 Karma

sowings
Splunk Employee
Splunk Employee

I was trying to do something with | rest /services/search/jobs, since it has PID and earliestTime, but for some reason my strptime call isn't parsing 1969-12-31T16:00:00-08:00 for me. Maybe somebody else can give that a whack.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...