Splunk® Enterprise

Search Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Saving and sharing jobs in Splunk Web

In Search, after you launch a search you can access and manage information about the search's job without leaving the Search page. Once your search is running, paused, or finalized, click Job and choose from the available options there.

6.0 search job dropdown.png

You can:

  • Edit the job settings. Select this to open the Job Settings dialog, where you can change the job's read permissions, extend the job's lifespan, and get a URL for the job that you can use to share the job with others or put a link to the job in your browser's bookmark bar.
  • Send the job to the background. Select this if the search job is slow to complete and you would like to run the job in the background while you work on other Splunk Enterprise activities (including running a new search job).
  • Inspect the job. Opens a separate window and display information and metrics for the search job via the Search Job Inspector.
  • Delete the job. Use this to delete a job that is currently running, is paused, or which has finalized. After you have deleted the job you can still save the search as a report.

Edit search job settings

You can open the Job Settings dialog after once a search job is running, paused, or finalized. Just click Job and select Edit Job Settings.

Change permissions for a search job

The read permissions for a search job determine whether a given job can be seen and accessed by others on the Jobs page. All jobs have read permissions set to Private by default, which means that only the people that run them can see a record for them on the Jobs page.

The Job Settings dialog has a Read Permissions switch that enables you to toggle the read permissions for a job to Everyone. The permissions are scoped to the app context that the job was run in, so an Everyone setting actually means that the job is visible on the Jobs page for everyone who has read permissions for the app to which the job belongs.

You can change the read permissions for a job back to Private if you are the owner of the job.

For more information about the Jobs page, see Manage search jobs in this manual.

Save a job by extending its lifespan

When you run a new search job, its default lifespan is 10 minutes. This means that the job will be retained by the system and be available for review via the Jobs page for 10 minutes from the moment that you first ran the job. After that time limit is up, the job expires--Splunk Enterprise deletes it from the system.

Whenever you access an existing job (by running it from the Jobs page for example), the job's lifespan is resets to a set period of time beginning from the moment it was accessed. This period of time will be 10 minutes until you change the job's Lifetime setting (see below).

To effectively "save" the job you open the Job Settings dialog and select a Lifetime setting of 7 days. This ensures that the job will be retained for 7 days before the system deletes it.

Whenever a job is accessed, its lifespan is reset to the moment of access. This happens whether the job lifespan is 10 minutes or 7 days. So if you set the lifespan for a job to 7 days and then access it (view the data it returns) 4 days later, its lifespan is reset so it won't expire for another 7 days.

Inspect a job

You can review a broad array of metrics and properties related to a job that you've launched in Search or Pivot by viewing it through the Search Job Inspector. Click Job and select Inspect Job to open the Search Job Inspector in a separate window.

You can access the Search Job Inspector for a job as long as the search or pivot artifact still exists (which means that the associated job has not expired).

For a detailed introduction to the Search Job Inspector and all of the information it provides, see Using the Search Job Inspector in this manual.

6.0 Search job inspector.png

Share a job with others

You can quickly share a job with other Splunk Enterprise users by sending them a link to the job. This can be handy if you want another user to see the results returned by the job. Keep in mind that this is not the same as sharing a report: when you share a job you are sharing the results of a specific run of a search.

There are two ways to obtain this link. You can use the Job Settings dialog as described above or you can use the Share icon that appears above your search or pivot results. If you use the Share icon, Splunk Enterprise will automatically set the job's read permissions to Everyone and extend its lifespan to 7 days.

6.0 share results icon.png

Either way, you'll get a Link To Job that you can paste in an email or text to the Splunk Enterprise user. However, if you use the Job Settings dialog to get the link you'll want to make sure that the job's Read Permissions are set to Everyone and set its Lifetime to 7 days. If the job's permissions are set to Private other users will be unable to access it via the link. The users you send the link to should also have permissions to use the app to which the job belongs.

6.0 share job dialog.png

You can also save the link for your own reuse by clicking the bookmark icon to the right of the Link To Job field and dragging it into your browser's bookmarks bar.

Export job data to a file

You can export the event data from a search or pivot job to a csv, xml, json, or raw data file, and then archive it or use it with a third-party charting application. To do this, run your search, and then select the Export icon that appears above your search or pivot results.

6.0 export search job results.png

You can set a limit for the number of events you want to export, or you can go ahead and export all the results returned by your search or pivot. Keep in mind that some searches return enormous numbers of events, so take precautions as necessary for your situation.

6.0 export results dialog.png

PREVIOUS
About jobs and job management
  NEXT
Manage search jobs

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters