Supervise your search jobs

Supervise your search jobs

Each time you run a search or generate a report, Splunk creates a job that contains the event data returned by that search or report. The Job Manager enables you to review and oversee your recently dispatched jobs, as well as those you may have saved earlier.

Just to be clear, jobs are not the same as saved searches and saved reports. Saved searches and saved reports contain data used to run those searches and reports, such as the search string and the time arguments used to dispatch searches. Jobs are artifacts of previously run searches and reports. They contain the results of a particular run of a search or report. Jobs are dispatched by scheduled searches as well as manual runs of searches and reports in the user interface.

For more information about saving searches see "Save searches" in this manual. For more information about saving reports, see "Save reports" in this manual.

You access the Job Manager by clicking the Jobs link in the upper right hand corner of the screen.

Note: When backgrounded searches are in progress, the Jobs link appears with the number of running jobs in parentheses.

Use the Job Manager to:

• See a list of the jobs you've recently dispatched or saved for later review, and use it to compare job statistics (run time, total count of events found, and so on).
• View the results of any job listed in the Job manager.
  • If the job is related to a search, you'll see the results in the Search view.
  • If the job is related to a report, you'll see the results in the Format Report page of the Report Builder.
  • Note: If a job is canceled while you have the Job Manager window open it can still appear in the Job Manager list, but you won't be able to view it. If you close and reopen the Job Manager, the canceled job should disappear.
• Check on the progress of ongoing backgrounded jobs or jobs dispatched by scheduled searches and pause or stop them if necessary.
• Save or delete any search or report job displayed on the Job Manager (if you have permissions to see and manage them).

Note: The Job Manager only displays search jobs that you have permission to see and manage.

Keep in mind that unsaved search jobs expire within a set period of time after they complete. The default lifespan for manually run search jobs is 15 minutes (search jobs resulting from scheduled searches typically have much shorter lifespans). The Expires column tells you how much time each list job has before it is deleted from the system. If you want to be able to review a search job after that expiration point, or share it with others, save it.

In most views you can save the last search or report job you ran without accessing the Job Manager page, as long as the job hasn't already expired.

• If you want to save a search job, select Save results from the Actions dropdown menu in the Search view.
• If you want to save a report job, select Save results only from the Save menu on the Report formatting page of the Report Builder.

For more information, see "About jobs and jobs management" in the Admin manual.

• Was this topic useful?
• Post a comment