My assumption is that you want to run a search in the UI then grab the results through our API; is that correct?
There are two ways to find the search ID (SID) of a job. One is to go to the search in the Splunk UI, click Job > Inspect Job. The Search job inspector will show you the SID in parenthesis.
You can also return the SID of various search jobs via API by using the POST command with the following call: https://host:mPort/services/search/jobs. The "host" and "mport" fields are place holders for your personal info.
You can view more info here: http://docs.splunk.com/Documentation/Splunk/6.6.3/RESTREF/RESTsearch#search.2Fjobs for this endpoint. If you expand the POST window, you can view all of the parameters available, but you shouldn’t need any of them unless you want to limit the number of searches, the timeframe, etc… Note, however, that if you choose not to use any parameters, I think all searches are returned, and that might take a really long time.
At the bottom of the expanded window, you can view various API calls that make use of the SID returned by the endpoint above. For example, to view the status of a job, you would call:
search/jobs/{search_id}
Where {search_id} is the SID returned by your original call (or copied from the Search job inspector in the UI).
I hope this answers your question.
Thanks,
Eve
