Dashboards & Visualizations

Need to get JOB.ID per instance per dashboard

robertlynch2020
Motivator

Hi

I have a list of all the ID RUNNING per dashboard (But if someone else is running the same dashboard i get those ID's as well, how can i reduce it down? ) I run this SPL from the dashboard i want to reduce it down to.

In this case the Dashboard is kpi_monitoring_robbie.

| rest /services/search/jobs | search dispatchState="RUNNING"  AND provenance="*kpi_monitoring_robbie*" 
| fields id provenance dispatchState

OUTPUT

id  provenance  dispatchState
https://127.0.0.1:8089/services/search/jobs/admin__admin__Murex__search60_1581445194.220651 UI:Dashboard:kpi_monitoring_robbie  RUNNING
https://127.0.0.1:8089/services/search/jobs/admin__admin__Murex__search61_1581445194.220652 UI:Dashboard:kpi_monitoring_robbie  RUNNING
https://127.0.0.1:8089/services/search/jobs/admin__admin__Murex__search63_1581445194.220654 UI:Dashboard:kpi_monitoring_robbie  RUNNING

But one of the above was from the second dashboard.
I cant do it per user as a lot of user have the same user name, if i was using LDAP i could.

Thanks in Advance
Robert

Tags (1)
0 Karma

codebuilder
Influencer

Try this (or adjust it to your needs):

| rest /services/search/jobs 
| cluster field=provenance showcount=t
| search dispatchState="RUNNING" AND provenance="kpi_monitoring_robbie"
| table cluster_count id dispatchState provenance

My example uses asterisks, just to get some data, but you get the idea.
alt text

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

robertlynch2020
Motivator

Thank for this, but i need to be able to get this per dashboards instance, not just per dashboard.

So i need a way to tell users at the end of a dashboard that there dashboard is 100% loaded.

However if i cluster i could have 2 separate people running the same dashboard it will group them together.

Cheers
Rob

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...