Gets information about a specific search job by ID.

External Documentation

To learn more, visit the Splunk documentation.

​
Parameters

ParameterDescription
Job IDThe ID of the job. You can retrieve this ID with the “List Search Jobs” action or by the search’s creation timestamp.

​
Example Output

{
	"links": {},
	"origin": "/services/search/jobs",
	"updated": "2023-01-15T10:31:38+02:00",
	"generator": {
		"build": "dd0128b1f8cd",
		"version": "9.0.3"
	},
	"entry": [
		{
			"name": "search source=\"udp:514\" sourcetype=\"syslog\"",
			"id": "/services/search/jobs/1673771306.191",
			"updated": "2023-01-15T10:31:38.524+02:00",
			"links": {
				"alternate": "/services/search/jobs/1673771306.191",
				"search_telemetry.json": "/services/search/jobs/1673771306.191/search_telemetry.json",
				"search.log": "/services/search/jobs/1673771306.191/search.log",
				"events": "/services/search/jobs/1673771306.191/events",
				"results": "/services/search/jobs/1673771306.191/results",
				"results_preview": "/services/search/jobs/1673771306.191/results_preview",
				"timeline": "/services/search/jobs/1673771306.191/timeline",
				"summary": "/services/search/jobs/1673771306.191/summary",
				"control": "/services/search/jobs/1673771306.191/control"
			},
			"published": "2023-01-15T10:28:26.000+02:00",
			"author": "example",
			"content": {
				"canSummarize": false,
				"cursorTime": "1970-01-01T02:00:00.000+02:00",
				"defaultSaveTTL": "604800",
				"defaultTTL": "600",
				"delegate": "",
				"diskUsage": 77824,
				"dispatchState": "DONE",
				"doneProgress": 1,
				"dropCount": 0,
				"earliestTime": "2023-01-14T10:00:00.000+02:00",
				"eventAvailableCount": 0,
				"eventCount": 0,
				"eventFieldCount": 0,
				"eventIsStreaming": true,
				"eventIsTruncated": false,
				"eventSearch": "search (source=\"udp:514\" sourcetype=\"syslog\")",
				"eventSorting": "desc",
				"isBatchModeSearch": false,
				"isDone": true,
				"isEventsPreviewEnabled": false,
				"isFailed": false,
				"isFinalized": false,
				"isPaused": false,
				"isPreviewEnabled": true,
				"isRealTimeSearch": false,
				"isRemoteTimeline": false,
				"isSaved": false,
				"isSavedSearch": false,
				"isTimeCursored": true,
				"isZombie": false,
				"is_prjob": false,
				"keywords": "source::udp:514 sourcetype::syslog",
				"label": "",
				"latestTime": "2023-01-15T10:28:26.000+02:00",
				"normalizedSearch": "litsearch (source=\"udp:514\" sourcetype=\"syslog\") | fields keepcolorder=t \"_bkt\" \"_cd\" \"_si\" \"host\" \"index\" \"linecount\" \"source\" \"sourcetype\" \"splunk_server\"",
				"numPreviews": 0,
				"optimizedSearch": "| search (source=\"udp:514\" sourcetype=\"syslog\")",
				"phase0": "litsearch (source=\"udp:514\" sourcetype=\"syslog\") | fields  keepcolorder=t \"*\" \"_bkt\" \"_cd\" \"_si\" \"host\" \"index\" \"linecount\" \"source\" \"sourcetype\" \"splunk_server\"",
				"phase1": "timeliner  remote=0 partial_commits=1 max_events_per_bucket=1000 fieldstats_update_maxperiod=60 bucket=300 extra_field=*",
				"pid": "48152",
				"priority": 5,
				"provenance": "UI:Search",
				"remoteSearch": "litsearch (source=\"udp:514\" sourcetype=\"syslog\") | fields  keepcolorder=t \"*\" \"_bkt\" \"_cd\" \"_si\" \"host\" \"index\" \"linecount\" \"source\" \"sourcetype\" \"splunk_server\"",
				"reportSearch": "",
				"resultCount": 0,
				"resultIsStreaming": true,
				"resultPreviewCount": 0,
				"runDuration": 0.10200000000000001,
				"sampleRatio": "1",
				"sampleSeed": "0",
				"scanCount": 0,
				"search": "search source=\"udp:514\" sourcetype=\"syslog\"",
				"searchCanBeEventType": true,
				"searchEarliestTime": 1673683200,
				"searchLatestTime": 1673771306,
				"searchTotalBucketsCount": 0,
				"searchTotalEliminatedBucketsCount": 0,
				"sid": "1673771306.191",
				"statusBuckets": 300,
				"ttl": 600,
				"workload_action_information": "",
				"workload_pool": "",
				"performance": {
					"command.fields": {
						"invocations": 1,
						"input_count": 0,
						"output_count": 0
					},
					"command.search": {
						"duration_secs": 0.001,
						"invocations": 1,
						"input_count": 0,
						"output_count": 0
					},
					"command.search.expand_search": {
						"duration_secs": 0.021,
						"invocations": 2
					},
					"command.search.expand_search.calcfield": {
						"invocations": 2
					},
					"command.search.expand_search.fieldaliaser": {
						"invocations": 2
					},
					"command.search.expand_search.indexed_fields": {
						"invocations": 2
					},
					"command.search.expand_search.kv": {
						"invocations": 2
					},
					"command.search.expand_search.lookup": {
						"invocations": 2
					},
					"command.search.expand_search.sourcetype": {
						"duration_secs": 0.006,
						"invocations": 2
					},
					"command.search.index": {
						"invocations": 1
					},
					"command.search.parse_directives": {
						"invocations": 2
					},
					"command.search.summary": {
						"invocations": 1
					},
					"command.search.track_sourcetypes": {
						"invocations": 1
					},
					"command.timeliner": {
						"duration_secs": 0.001,
						"invocations": 2,
						"input_count": 0,
						"output_count": 0
					},
					"dispatch.createdSearchResultInfrastructure": {
						"duration_secs": 0.003,
						"invocations": 1
					},
					"dispatch.evaluate.search": {
						"duration_secs": 0.043,
						"invocations": 2
					},
					"dispatch.fetch.rcp.phase_0": {
						"duration_secs": 0.023,
						"invocations": 2
					},
					"dispatch.finalWriteToDisk": {
						"invocations": 1
					},
					"dispatch.localSearch": {
						"duration_secs": 0.001,
						"invocations": 1
					},
					"dispatch.readEventsInResults": {
						"invocations": 1
					},
					"dispatch.stream.local": {
						"duration_secs": 0.001,
						"invocations": 1
					},
					"dispatch.timeline": {
						"invocations": 2
					},
					"dispatch.writeStatus": {
						"duration_secs": 0.002,
						"invocations": 3
					},
					"startup.configuration": {
						"duration_secs": 0.041,
						"invocations": 2
					},
					"startup.handoff": {
						"duration_secs": 0.04,
						"invocations": 2
					}
				},
				"messages": [],
				"request": {
					"adhoc_search_level": "smart",
					"auto_cancel": "62",
					"check_risky_command": "false",
					"custom.search": "source=\"udp:514\" sourcetype=\"syslog\"",
					"earliest_time": "-24h@h",
					"indexedRealtime": "",
					"latest_time": "now",
					"preview": "1",
					"provenance": "UI:Search",
					"rf": "*",
					"sample_ratio": "1",
					"search": "search source=\"udp:514\" sourcetype=\"syslog\"",
					"status_buckets": "300",
					"ui_dispatch_app": "Blink",
					"workload_pool": ""
				},
				"custom": {
					"search": "source=\"udp:514\" sourcetype=\"syslog\""
				},
				"runtime": {
					"auto_cancel": "62",
					"auto_pause": "0"
				},
				"searchProviders": [
					"examples-MacBook-Pro.local"
				],
				"searchTelemetry": {
					"timestamp": "1673771306.329828",
					"type": "ad-hoc",
					"search_id": "1673771306.191",
					"status": "success",
					"ast": {
						"ast_optimize": true,
						"ast_visitor": [
							"predicate_push",
							"search_expansion",
							"predicate_merge",
							"predicate_split",
							"search_sort_normalization",
							"search_flip_normalization",
							"eval_merge",
							"projection_elimination"
						],
						"ast_modified": [
							"predicate_push"
						]
					},
					"desc": {
						"app": "Blink",
						"provenance": "UI:Search",
						"earliest_time": 1673683200,
						"latest_time": 1673771306,
						"comments": false,
						"batch_mode_search": false,
						"nested_subsearches_flag": false,
						"sourcetypes": {},
						"search_process_modes": {
							"undefined": 0,
							"freestanding": 0,
							"forked": 0,
							"preforked_first": 0,
							"preforked_same_user": 1,
							"preforked_different_user": 0
						}
					},
					"perf": {
						"bytes_read": 0,
						"scan_count": 0,
						"results_count": 0,
						"subsearch_count": 0,
						"search_runtime_secs": 0.102,
						"search_preview_time_secs": 0,
						"execution_cost": {
							"dispatch.finalWriteToDisk": 0.000018834,
							"dispatch.evaluate": 0.03266425,
							"dispatch.timeline": 0.000008541,
							"dispatch.createdSearchResultInfrastructure": 0.003169417,
							"dispatch.localSearch": 0.000662167,
							"dispatch.writeStatus": 0.0013265,
							"dispatch.stream.local": 0.000617583,
							"dispatch.readEventsInResults": 0.000350583
						}
					},
					"phases": {
						"phases_count": 2,
						"phase_1": {
							"elapsed_time_aggregations": {
								"avg": 0.108,
								"max": 0.108,
								"min": 0.108,
								"sum": 0.108,
								"count": 1
							},
							"nodes_count": 1
						}
					},
					"buckets": {
						"bloom_eliminated_rawsize": 0,
						"bloom_eliminated_buckets": 0,
						"meta_eliminated_buckets": 0,
						"searched_buckets": 0,
						"max_bucket_fetch_secs": 0
					},
					"feature_flags": {
						"enabled": [
							"parallelreduce:enablePreview",
							"stats:allow_stats_v2",
							"search:read_final_results_from_timeliner"
						]
					},
					"search_commands": [
						{
							"name": "resultsCollationProcessor",
							"duration": 0.022703875,
							"maxPeerDuration": 0.022703875,
							"aggregates": {
								"outputCount": {
									"min": 0,
									"max": 0,
									"sum": 0,
									"avg": 0,
									"count": 1
								}
							},
							"telemetryID": "13816492849422245250.0.0",
							"dagID": "1.0"
						},
						{
							"name": "timeliner",
							"duration": 0.000755,
							"maxPeerDuration": 0.000755,
							"telemetryID": "1497244161992834864.0.0",
							"dagID": "1.1"
						},
						{
							"name": "litsearch",
							"duration": 0.000599167,
							"maxPeerDuration": 0.000599167,
							"telemetryID": "10053701751655094029.0.0",
							"dagID": ""
						},
						{
							"name": "fields",
							"duration": 0.000005541,
							"maxPeerDuration": 0.000005541,
							"telemetryID": "10053701751655094029.0.1",
							"dagID": ""
						}
					]
				}
			},
			"acl": {
				"perms": {
					"read": [
						"example"
					],
					"write": [
						"example"
					]
				},
				"owner": "example",
				"modifiable": true,
				"sharing": "global",
				"app": "Blink",
				"can_write": true,
				"ttl": "600"
			}
		}
	],
	"paging": {
		"total": 1,
		"perPage": 0,
		"offset": 0
	}
}

​
Workflow Library Example

Get Search Job by Id with Splunk and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?