Hi all,
I have below link for a search, but when I click it, it shows nothing but only said: Unknown sid. I need to remove this search, but I don't know what is the search string inside.
May I know according to this sid, is there any way to find the search body from it?
https://***/search?sid=1476267099.133508
Thanks
wu
So can get search body and other details by executing this rest command
| rest /services/search/jobs/1499263157.5501 splunk_server=local
Below is the link,
http://docs.splunk.com/Documentation/Splunk/6.6.2/RESTREF/RESTsearch
After the search expires it is no longer accessible by that URL. you can however check the _audit index. Try the following search
index=_audit search_id=1476267099.133508 info=granted search=*
There is a field called search which will show you the SPL that was used
Sorry, I need recover this search ,not remove.