Run a Search Job and Retrieve Results
A 3-step recipe with Splunk. We can help you get access.
Recipe · 3 steps
Run a Search Job and Retrieve Results
with Splunk · Observability Management
Create a search job, poll it to completion, and fetch its results.
- Dispatch the SPL search as an asynchronous search job and capture the assigned search ID (sid).
- Read the search job status. The job is finished when dispatchState reports DONE; otherwise the step is retried.
- Retrieve the transformed results of the completed search job in JSON, paginated by count and offset.
What you'll need to have ready
- search: The SPL search query to execute (e.g. "search index=main | head 100").
- earliest_time: Earliest time boundary for the search (e.g. "-24h@h").
- latest_time: Latest time boundary for the search (e.g. "now").
- count: Maximum number of results to return.
For your developer
Arazzo workflow splunk:run-search-job, 3 operations: createSearchJob → getSearchJob → getSearchResults. Specs on APIs.io.