SID
with actions like Get Search Job By ID
to check the job’s status (available under the entry.content.dispatchState
key).
Once the status is DONE
, you can retrieve the results using the Get Search Job Results
action.
Parameter | Description |
---|---|
Ad Hoc Search Level | The search level of the created search. For more information, refer to the Splunk Documentation. |
Earliest Time | Specify a time string to set the inclusive start of the search. |
Execution Mode | Set to normal , in order to run an asynchronous search.Set to blocking , in order to return the sid when the job is complete. |
Latest Time | Specify a time string to set the inclusive end of the search. |
Output Mode Results | Specify the format for the returned output. |
Search Mode | Set to realtime to search live incoming data, or normal to run a one-time search over historical indexed data. |
Search Query | The search query the created job will run. |
Parameter | Description |
---|---|
Add Summary To Metadata | Select to include field summary statistics in the response. |
Custom ID | Optional string to specify the search ID (<sid> ). If unspecified, a random ID is generated. |