To learn more, visit the Splunk documentation.

Parameters

ParameterDescription
Job IDThe ID of the job. You can retrieve this ID with the “List Search Jobs” action or by the search’s creation timestamp.

Example Output

{    "links": {},    "origin": "/services/search/jobs",    "updated": "2023-01-15T10:31:38+02:00",    "generator": {        "build": "dd0128b1f8cd",        "version": "9.0.3"    },    "entry": [        {            "name": "search source=\"udp:514\" sourcetype=\"syslog\"",            "id": "/services/search/jobs/1673771306.191",            "updated": "2023-01-15T10:31:38.524+02:00",            "links": {                "alternate": "/services/search/jobs/1673771306.191",                "search_telemetry.json": "/services/search/jobs/1673771306.191/search_telemetry.json",                "search.log": "/services/search/jobs/1673771306.191/search.log",                "events": "/services/search/jobs/1673771306.191/events",                "results": "/services/search/jobs/1673771306.191/results",                "results_preview": "/services/search/jobs/1673771306.191/results_preview",                "timeline": "/services/search/jobs/1673771306.191/timeline",                "summary": "/services/search/jobs/1673771306.191/summary",                "control": "/services/search/jobs/1673771306.191/control"            },            "published": "2023-01-15T10:28:26.000+02:00",            "author": "example",            "content": {                "canSummarize": false,                "cursorTime": "1970-01-01T02:00:00.000+02:00",                "defaultSaveTTL": "604800",                "defaultTTL": "600",                "delegate": "",                "diskUsage": 77824,                "dispatchState": "DONE",                "doneProgress": 1,                "dropCount": 0,                "earliestTime": "2023-01-14T10:00:00.000+02:00",                "eventAvailableCount": 0,                "eventCount": 0,                "eventFieldCount": 0,                "eventIsStreaming": true,                "eventIsTruncated": false,                "eventSearch": "search (source=\"udp:514\" sourcetype=\"syslog\")",                "eventSorting": "desc",                "isBatchModeSearch": false,                "isDone": true,                "isEventsPreviewEnabled": false,                "isFailed": false,                "isFinalized": false,                "isPaused": false,                "isPreviewEnabled": true,                "isRealTimeSearch": false,                "isRemoteTimeline": false,                "isSaved": false,                "isSavedSearch": false,                "isTimeCursored": true,                "isZombie": false,                "is_prjob": false,                "keywords": "source::udp:514 sourcetype::syslog",                "label": "",                "latestTime": "2023-01-15T10:28:26.000+02:00",                "normalizedSearch": "litsearch (source=\"udp:514\" sourcetype=\"syslog\") | fields keepcolorder=t \"_bkt\" \"_cd\" \"_si\" \"host\" \"index\" \"linecount\" \"source\" \"sourcetype\" \"splunk_server\"",                "numPreviews": 0,                "optimizedSearch": "| search (source=\"udp:514\" sourcetype=\"syslog\")",                "phase0": "litsearch (source=\"udp:514\" sourcetype=\"syslog\") | fields  keepcolorder=t \"*\" \"_bkt\" \"_cd\" \"_si\" \"host\" \"index\" \"linecount\" \"source\" \"sourcetype\" \"splunk_server\"",                "phase1": "timeliner  remote=0 partial_commits=1 max_events_per_bucket=1000 fieldstats_update_maxperiod=60 bucket=300 extra_field=*",                "pid": "48152",                "priority": 5,                "provenance": "UI:Search",                "remoteSearch": "litsearch (source=\"udp:514\" sourcetype=\"syslog\") | fields  keepcolorder=t \"*\" \"_bkt\" \"_cd\" \"_si\" \"host\" \"index\" \"linecount\" \"source\" \"sourcetype\" \"splunk_server\"",                "reportSearch": "",                "resultCount": 0,                "resultIsStreaming": true,                "resultPreviewCount": 0,                "runDuration": 0.10200000000000001,                "sampleRatio": "1",                "sampleSeed": "0",                "scanCount": 0,                "search": "search source=\"udp:514\" sourcetype=\"syslog\"",                "searchCanBeEventType": true,                "searchEarliestTime": 1673683200,                "searchLatestTime": 1673771306,                "searchTotalBucketsCount": 0,                "searchTotalEliminatedBucketsCount": 0,                "sid": "1673771306.191",                "statusBuckets": 300,                "ttl": 600,                "workload_action_information": "",                "workload_pool": "",                "performance": {                    "command.fields": {                        "invocations": 1,                        "input_count": 0,                        "output_count": 0                    },                    "command.search": {                        "duration_secs": 0.001,                        "invocations": 1,                        "input_count": 0,                        "output_count": 0                    },                    "command.search.expand_search": {                        "duration_secs": 0.021,                        "invocations": 2                    },                    "command.search.expand_search.calcfield": {                        "invocations": 2                    },                    "command.search.expand_search.fieldaliaser": {                        "invocations": 2                    },                    "command.search.expand_search.indexed_fields": {                        "invocations": 2                    },                    "command.search.expand_search.kv": {                        "invocations": 2                    },                    "command.search.expand_search.lookup": {                        "invocations": 2                    },                    "command.search.expand_search.sourcetype": {                        "duration_secs": 0.006,                        "invocations": 2                    },                    "command.search.index": {                        "invocations": 1                    },                    "command.search.parse_directives": {                        "invocations": 2                    },                    "command.search.summary": {                        "invocations": 1                    },                    "command.search.track_sourcetypes": {                        "invocations": 1                    },                    "command.timeliner": {                        "duration_secs": 0.001,                        "invocations": 2,                        "input_count": 0,                        "output_count": 0                    },                    "dispatch.createdSearchResultInfrastructure": {                        "duration_secs": 0.003,                        "invocations": 1                    },                    "dispatch.evaluate.search": {                        "duration_secs": 0.043,                        "invocations": 2                    },                    "dispatch.fetch.rcp.phase_0": {                        "duration_secs": 0.023,                        "invocations": 2                    },                    "dispatch.finalWriteToDisk": {                        "invocations": 1                    },                    "dispatch.localSearch": {                        "duration_secs": 0.001,                        "invocations": 1                    },                    "dispatch.readEventsInResults": {                        "invocations": 1                    },                    "dispatch.stream.local": {                        "duration_secs": 0.001,                        "invocations": 1                    },                    "dispatch.timeline": {                        "invocations": 2                    },                    "dispatch.writeStatus": {                        "duration_secs": 0.002,                        "invocations": 3                    },                    "startup.configuration": {                        "duration_secs": 0.041,                        "invocations": 2                    },                    "startup.handoff": {                        "duration_secs": 0.04,                        "invocations": 2                    }                },                "messages": [],                "request": {                    "adhoc_search_level": "smart",                    "auto_cancel": "62",                    "check_risky_command": "false",                    "custom.search": "source=\"udp:514\" sourcetype=\"syslog\"",                    "earliest_time": "-24h@h",                    "indexedRealtime": "",                    "latest_time": "now",                    "preview": "1",                    "provenance": "UI:Search",                    "rf": "*",                    "sample_ratio": "1",                    "search": "search source=\"udp:514\" sourcetype=\"syslog\"",                    "status_buckets": "300",                    "ui_dispatch_app": "Blink",                    "workload_pool": ""                },                "custom": {                    "search": "source=\"udp:514\" sourcetype=\"syslog\""                },                "runtime": {                    "auto_cancel": "62",                    "auto_pause": "0"                },                "searchProviders": [                    "examples-MacBook-Pro.local"                ],                "searchTelemetry": {                    "timestamp": "1673771306.329828",                    "type": "ad-hoc",                    "search_id": "1673771306.191",                    "status": "success",                    "ast": {                        "ast_optimize": true,                        "ast_visitor": [                            "predicate_push",                            "search_expansion",                            "predicate_merge",                            "predicate_split",                            "search_sort_normalization",                            "search_flip_normalization",                            "eval_merge",                            "projection_elimination"                        ],                        "ast_modified": [                            "predicate_push"                        ]                    },                    "desc": {                        "app": "Blink",                        "provenance": "UI:Search",                        "earliest_time": 1673683200,                        "latest_time": 1673771306,                        "comments": false,                        "batch_mode_search": false,                        "nested_subsearches_flag": false,                        "sourcetypes": {},                        "search_process_modes": {                            "undefined": 0,                            "freestanding": 0,                            "forked": 0,                            "preforked_first": 0,                            "preforked_same_user": 1,                            "preforked_different_user": 0                        }                    },                    "perf": {                        "bytes_read": 0,                        "scan_count": 0,                        "results_count": 0,                        "subsearch_count": 0,                        "search_runtime_secs": 0.102,                        "search_preview_time_secs": 0,                        "execution_cost": {                            "dispatch.finalWriteToDisk": 0.000018834,                            "dispatch.evaluate": 0.03266425,                            "dispatch.timeline": 0.000008541,                            "dispatch.createdSearchResultInfrastructure": 0.003169417,                            "dispatch.localSearch": 0.000662167,                            "dispatch.writeStatus": 0.0013265,                            "dispatch.stream.local": 0.000617583,                            "dispatch.readEventsInResults": 0.000350583                        }                    },                    "phases": {                        "phases_count": 2,                        "phase_1": {                            "elapsed_time_aggregations": {                                "avg": 0.108,                                "max": 0.108,                                "min": 0.108,                                "sum": 0.108,                                "count": 1                            },                            "nodes_count": 1                        }                    },                    "buckets": {                        "bloom_eliminated_rawsize": 0,                        "bloom_eliminated_buckets": 0,                        "meta_eliminated_buckets": 0,                        "searched_buckets": 0,                        "max_bucket_fetch_secs": 0                    },                    "feature_flags": {                        "enabled": [                            "parallelreduce:enablePreview",                            "stats:allow_stats_v2",                            "search:read_final_results_from_timeliner"                        ]                    },                    "search_commands": [                        {                            "name": "resultsCollationProcessor",                            "duration": 0.022703875,                            "maxPeerDuration": 0.022703875,                            "aggregates": {                                "outputCount": {                                    "min": 0,                                    "max": 0,                                    "sum": 0,                                    "avg": 0,                                    "count": 1                                }                            },                            "telemetryID": "13816492849422245250.0.0",                            "dagID": "1.0"                        },                        {                            "name": "timeliner",                            "duration": 0.000755,                            "maxPeerDuration": 0.000755,                            "telemetryID": "1497244161992834864.0.0",                            "dagID": "1.1"                        },                        {                            "name": "litsearch",                            "duration": 0.000599167,                            "maxPeerDuration": 0.000599167,                            "telemetryID": "10053701751655094029.0.0",                            "dagID": ""                        },                        {                            "name": "fields",                            "duration": 0.000005541,                            "maxPeerDuration": 0.000005541,                            "telemetryID": "10053701751655094029.0.1",                            "dagID": ""                        }                    ]                }            },            "acl": {                "perms": {                    "read": [                        "example"                    ],                    "write": [                        "example"                    ]                },                "owner": "example",                "modifiable": true,                "sharing": "global",                "app": "Blink",                "can_write": true,                "ttl": "600"            }        }    ],    "paging": {        "total": 1,        "perPage": 0,        "offset": 0    }}

Workflow Library Example

Get Search Job by Id with Splunk and Send Results Via Email

Preview this Workflow on desktop