SearchJobs
Create, query, update, and delete search jobs in Splunk.
Select
The connector will use the Splunk APIs to process the search Id (Sid) criteria specified in the WHERE clause. The Sid column supports server-side processing for the = operator. The connector processes other search criteria client-side within the connector.
SELECT * FROM SearchJobs SELECT * FROM SearchJobs WHERE Sid = '123456789.1234'
Insert
Splunk allows inserts only when EventSearch is specified. You can insert the Custom, EarliestTime, LatestTime, Label, and StatusBuckets columns and all pseudocolumns.
INSERT INTO SearchJobs (Custom, EventSearch, LatestTime, Timeout) VALUES ('custom1=test1, custom2=test2', ' from datamodel SampleModel', 'now', '60')
Update
The SearchJobs table allows updates of the Custom column only when Sid is specified.
UPDATE SearchJobs SET Custom = 'custom1=test3, custom2=test4' WHERE sid = '123456789.1234'
Delete
SearchJobs can be deleted by providing the Sid.
DELETE FROM SearchJobs WHERE Sid = '123456789.1234'
Columns
| Name | Type | ReadOnly | References | Description |
| Sid [KEY] | String | False |
The search Id number. | |
| EventSearch | String | False |
Subset of the entire search that is before any transforming commands. | |
| Custom | String | False |
Custom job property. In an INSERT operation, pass the values as a comma-separated list of pairs of keys and values. | |
| EarliestTime | String | False |
The earliest time a search job is configured to start. | |
| LatestTime | String | False |
The latest time a search job is configured to start. | |
| CursorTime | String | True |
The earliest time from which no events are later scanned. Can be used to indicate progress. | |
| Delegate | String | True |
For saved searches, specifies jobs that were started by the user. Defaults to scheduler. | |
| DiskUsage | Long | True |
The total amount of disk space used, in bytes. | |
| DispatchState | String | True |
The state of the search. Can be any of QUEUED, PARSING, RUNNING, PAUSED, FINALIZING, FAILED, or DONE. | |
| DoneProgress | Double | True |
A number between 0 and 1.0 that indicates the approximate progress of the search. doneProgress = (latestTime-cursorTime) / (latestTime-earliestTime) | |
| DropCount | Integer | True |
For real-time searches only, the number of possible events that were dropped due to the rt_queue_size (defaults to 100000). | |
| EventAvailableCount | Integer | True |
The number of events that are available for export. | |
| EventCount | Integer | True |
The number of events returned by the search. | |
| EventFieldCount | Integer | True |
The number of fields found in the search results. | |
| EventIsStreaming | Boolean | True |
Indicates if the events of this search are being streamed. | |
| EventIsTruncated | Boolean | True |
Indicates if the events of the search are not stored, making them unavailable from the events endpoint for the search. | |
| EventPreviewableCount | Integer | True |
Number of in-memory events that are not yet committed to disk. | |
| EventSorting | String | True |
Indicates if the events of this search are sorted, and in which order. | |
| IsDone | Boolean | True |
Indicates if the search has completed. | |
| IsEventsPreviewEnabled | String | True |
Indicates if the timeline_events_preview setting is enabled in limits.conf. | |
| IsFailed | Boolean | True |
Indicates if there was a fatal error executing the search. For example, invalid search string syntax. | |
| IsFinalized | Boolean | True |
Indicates if the search was finalized (stopped before completion). | |
| IsPaused | Boolean | True |
Indicates if the search is paused. | |
| IsPreviewEnabled | Boolean | True |
Indicates if previews are enabled. | |
| IsRealTimeSearch | Boolean | True |
Indicates if the search is a real-time search. | |
| IsRemoteTimeline | Boolean | True |
Indicates if the remote timeline feature is enabled. | |
| IsSaved | Boolean | True |
Indicates that the search job is saved on disk. Search artifacts are saved on disk for 7 days from the last time that the job was viewed or touched. | |
| IsSavedSearch | Boolean | True |
Indicates if this is a saved search run using the scheduler. | |
| IsZombie | Boolean | True |
Indicates if the process running the search died without finishing the search. | |
| Keywords | String | True |
All positive keywords used by this search. A positive keyword is a keyword that is not in a NOT clause. | |
| Label | String | False |
Custom name created for this search. | |
| Messages | String | True |
Errors and debug messages. | |
| NumPreviews | Integer | True |
Number of previews generated so far for this search job. | |
| Performance | String | True |
A representation of the execution costs. | |
| Priority | Integer | True |
An integer between 0-10 that indicates the search priority. | |
| RemoteSearch | String | True |
The search string that is sent to every search peer. | |
| ReportSearch | String | True |
If reporting commands are used, the reporting search. | |
| ResultCount | Integer | True |
The total number of results returned by the search. In other words, this is the subset of scanned events (represented by the ScanCount) that actually matches the search terms. | |
| ResultIsStreaming | Boolean | True |
Indicates if the final results of the search are available using streaming (for example, no transforming operations). | |
| ResultPreviewCount | Integer | True |
The number of result rows in the latest preview results. | |
| RunDuration | Decimal | True |
Time in seconds that the search took to complete. | |
| ScanCount | Integer | True |
The number of events that are scanned or read off disk. | |
| SearchEarliestTime | Datetime | True |
Specifies the earliest time for a search, as specified in the search command rather than the EarliestTime parameter. It does not snap to the indexed data time bounds for all-time searches. | |
| SearchLatestTime | Datetime | True |
Specifies the latest time for a search, as specified in the search command rather than the LatestTime parameter. It does not snap to the indexed data time bounds for all-time searches. | |
| SearchProviders | String | True |
A list of all the search peers that were contacted. | |
| StatusBuckets | Integer | False |
Maximum number of timeline buckets. | |
| TTL | String | True |
The time to live, or the time before the search job expires after it completes. |
Pseudo-Columns
SELECT ステートメントのWHERE 句では、疑似カラムフィールドを使用して、データソースから返されるタプルを詳細に制御することができます。
| Name | Type | Description |
| SearchMode | String |
Searching mode, realtime or normal. If set to realtime, the search runs over the live data. 使用できる値は次のとおりです。normal, realtime |
| EnableLookups | Boolean |
Indicates whether lookups should be applied to events. |
| AutoPause | Integer |
If specified, the search job pauses after this many seconds of inactivity. (0 means never autopause.) |
| AutoCancel | Integer |
If specified, the job automatically cancels after this many seconds of inactivity. (0 means never autocancel.) |
| AdhocSearchLevel | Integer |
Specify a search mode. Use one of the following search modes: verbose, fast, or smart. 使用できる値は次のとおりです。verbose, fast, smart |
| ForceBundleReplication | Boolean |
Specifies whether this search should cause (and wait depending on the value of SyncBundleReplication) for bundle synchronization with all search peers. |
| IndexEarliest | String |
Specify a time string. Sets the earliest inclusive time bounds for the search, based on the index time bounds. |
| IndexLatest | String |
Specify a time string. Sets the latest exclusive time bounds for the search, based on the index time bounds. |
| IndexedRealtime | Boolean |
Indicates whether or not to use the indexed-realtime mode for real-time searches. |
| IndexedRealtimeOffset | Integer |
Sets disk sync delay for indexed real-time search (seconds). |
| MaxCount | Integer |
The number of events that can be accessible in any given status bucket. |
| MaxTime | Integer |
Comma-separated list of (possibly wildcarded) servers from which raw events should be pulled. |
| Namespace | String |
The application namespace in which to restrict searches. |
| Now | String |
Specify a time string to set the absolute time used for any relative time specifier in the search. Defaults to the current system time. You can specify a relative time modifier for this parameter. For example, specify +2d to specify the current time plus two days. |
| ReduceFrequency | Integer |
Determines how frequently to run the MapReduce reduce phase on accumulated map values. |
| ReloadMacros | Boolean |
Specifies whether to reload macro definitions from the configuration file. |
| RemoteServerList | Integer |
The number of seconds to run this search before finalizing. Specify 0 to never finalize. |
| ReplaySpeed | Integer |
Indicate a real-time search replay speed factor. For example, 1 indicates normal speed, 0.5 indicates half of normal speed, and 2 indicates twice as fast as normal. |
| ReplayStartTime | String |
Relative wall-clock start time for the replay. |
| ReplayEndTime | String |
Relative end time for the replay clock. The replay stops when the clock time reaches this time. |
| ReuseMaxSecondsAgo | Integer |
Specifies the number of seconds ago to check when an identical search is started and return the search Id of the job instead of starting a new job. |
| RequiredField | String |
Adds a required field to the search. |
| RealTimeBlocking | Boolean |
For a real-time search, indicates if the indexer blocks if the queue for this search is full. |
| RealTimeIndexFilter | Boolean |
For a real-time search, indicates if the indexer prefilters events. |
| RealTimeMaxBlockSecs | Integer |
For a real-time search with RealTimeBlocking set to true, the maximum time to block. Specify 0 to indicate no limit. |
| RealTimeQueueSize | Integer |
For a real-time search, the queue size (in events) that the indexer should use for this search. |
| Timeout | Integer |
The number of seconds to keep this search after processing has stopped. |
| SyncBundleReplication | String |
Specifies whether this search should wait for bundle replication to complete. |