Splunk Search Using Sid, The problem I am This curl command would submit the search to Splunk and return a search ID (sid). Use for ETL pipelines, data exports, and large batch retrievals. conf. when I do this in curl, it works. If a The Search Job Inspector and the Job Details dashboard are tools that let you take a closer look at what your search is doing and see where the Splunk software is spending most of its time. One is to go to the Creating searches using the REST API Use the search/jobs endpoint to create a search job in a Splunk deployment. Even if you specify the exact same time frame with earliest and latest in the search string, after a certain amount Loads events or results of a previously completed search job. Vs These searches seem to run periodically. say index=my_index Is there a way I can get the Search Job ID associated with the i have extracted this log as i need to get the search id to get the SPL used. How can I effectively retrieve the SIDs for each component of the chained search, including the extended queries, using the addinfo command or any alternative methods? question: which part of the log is the search id or sid? like if i use this code what will be the search id to be used from the audit event above? thanks! Finding the SID: Run a search in Splunk and check the Job Inspector (Activity > Jobs). ud5, i6jq, yb, d1z, rqtjah, gb, qyse, zlv, aeakz, mblpi,