Dashboards & Visualizations

Need to get JOB.ID per instance per dashboard

robertlynch2020
Motivator

Hi

I have a list of all the ID RUNNING per dashboard (But if someone else is running the same dashboard i get those ID's as well, how can i reduce it down? ) I run this SPL from the dashboard i want to reduce it down to.

In this case the Dashboard is kpi_monitoring_robbie.

| rest /services/search/jobs | search dispatchState="RUNNING"  AND provenance="*kpi_monitoring_robbie*" 
| fields id provenance dispatchState

OUTPUT

id  provenance  dispatchState
https://127.0.0.1:8089/services/search/jobs/admin__admin__Murex__search60_1581445194.220651 UI:Dashboard:kpi_monitoring_robbie  RUNNING
https://127.0.0.1:8089/services/search/jobs/admin__admin__Murex__search61_1581445194.220652 UI:Dashboard:kpi_monitoring_robbie  RUNNING
https://127.0.0.1:8089/services/search/jobs/admin__admin__Murex__search63_1581445194.220654 UI:Dashboard:kpi_monitoring_robbie  RUNNING

But one of the above was from the second dashboard.
I cant do it per user as a lot of user have the same user name, if i was using LDAP i could.

Thanks in Advance
Robert

Tags (1)
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Try this (or adjust it to your needs):

| rest /services/search/jobs 
| cluster field=provenance showcount=t
| search dispatchState="RUNNING" AND provenance="kpi_monitoring_robbie"
| table cluster_count id dispatchState provenance

My example uses asterisks, just to get some data, but you get the idea.
alt text

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

robertlynch2020
Motivator

Thank for this, but i need to be able to get this per dashboards instance, not just per dashboard.

So i need a way to tell users at the end of a dashboard that there dashboard is 100% loaded.

However if i cluster i could have 2 separate people running the same dashboard it will group them together.

Cheers
Rob

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...