Splunk Search

How can I get the job id from Splunk?

Palrav12
New Member

I need job id from Splunk. How to get the job id from Splunk? I execute the curl command but I didn't get the Job id , please help me out how to get it.

0 Karma

emeelan_splunk
Splunk Employee
Splunk Employee

My assumption is that you want to run a search in the UI then grab the results through our API; is that correct?

There are two ways to find the search ID (SID) of a job. One is to go to the search in the Splunk UI, click Job > Inspect Job. The Search job inspector will show you the SID in parenthesis.

You can also return the SID of various search jobs via API by using the POST command with the following call: https://host:mPort/services/search/jobs. The "host" and "mport" fields are place holders for your personal info.

You can view more info here: http://docs.splunk.com/Documentation/Splunk/6.6.3/RESTREF/RESTsearch#search.2Fjobs for this endpoint. If you expand the POST window, you can view all of the parameters available, but you shouldn’t need any of them unless you want to limit the number of searches, the timeframe, etc… Note, however, that if you choose not to use any parameters, I think all searches are returned, and that might take a really long time.

At the bottom of the expanded window, you can view various API calls that make use of the SID returned by the endpoint above. For example, to view the status of a job, you would call:

search/jobs/{search_id}

Where {search_id} is the SID returned by your original call (or copied from the Search job inspector in the UI).

I hope this answers your question.

Thanks,
Eve

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @palrav12, I saw this similar post.
The answer is for an older version of Splunk, but I found this newer version

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...