Splunk® Enterprise

Search Manual

Download manual as PDF

Download topic as PDF

Inspect search job properties

The Search Job Inspector is a tool that lets you take a closer look at what your current search job is doing. You can see where the search processing is spending most of its time, by looking at the job execution costs and search job properties.

With the Search Job Inspector, you can review a broad array of metrics and properties related to a job. You can troubleshoot the performance of a search job, and understand the behavior of knowledge objects such as event types, tags, lookups, and so on within the search.

Open the Search Job Inspector

You can access the Search Job Inspector for a search job as long as the search has not expired, which means that the search artifact still exists. The search does not need to be running to inspect the search job.

To inspect a search:

  1. Run the search.
  2. In the Job menu, select Inspect Job. This opens the Search Job Inspector in a new browser window.
6.4 job inspector.png

Now, what exactly are you looking at?

What the Search Job Inspector shows you



Execution costs
Search job properties
The Search job properties section lists other characteristics of the job.

Execution costs


  • The component durations in seconds.
  • The input and output event counts for each component.



Execution costs of search commands


Search command component name Description
command.search After Splunk software identifies the events containing the indexed fields matching your search, it identifies the ones that match other criteria. These are concurrent operations, not consecutive.
  • command.search.typer - tells how long it took identify event types.
  • command.search.filter - tells how long it took to filter out events that don't match (for example, fields and phrases).


Execution costs of dispatched searches

Distributed search component name Description
dispatch.check_disk_usage The time spent checking the disk usage of this job.
dispatch.emit_prereport_files When running a transforming search, the statistical results of the report cannot be computed until the search completes. After it fetches events from the search peers (dispatch.fetch), it, writes out the results to local files. dispatch.emit_prereport_files provides the time that it takes for the transforming search results to be written to those local files.
dispatch.fetch The time spent waiting for or fetching events from search peers.
dispatch.preview The time spent generating preview results.
dispatch.process_remote_timeline The time spent decoding timeline information generated by search peers.
dispatch.reduce The time spend reducing the intermediate report output.
dispatch.timeline The time spent generating the timeline and fields sidebar information.

Search job properties

The following table describes the most common search job properties fields. The fields in this table are listed in alphabetical order.

Parameter name Description
diskUsage The total amount of disk space used, in bytes.


eventAvailableCount The number of events that are available for export.
eventCount The number of events returned by the search.
eventFieldCount The number of fields found in the search results.
eventIsStreaming Indicates if the events of this search are being streamed.
isDone Indicates if the search has completed.
isPaused Indicates if the search has been paused.
isPreviewEnabled Indicates if previews are enabled.
isRealTimeSearch Indicates if the search is a real time search.
isRemoteTimeline Indicates if the remote timeline feature is enabled.
isSaved Indicates that the search job is saved, storing search artifacts on disk for 7 days from the last time that the job has been viewed or touched. In Splunk Enterprise you can override the default value of 7 days by editing the value of the default_save_ttl setting in limits.conf
label Custom name created for this search.
messages Errors and debug messages.
performance This is another representation of the Execution costs.
remoteSearch The search string that is sent to every search peer.
reportSearch If reporting commands are used, the reporting search.
request GET arguments that the search sends to the Splunk search engine.
resultCount The total number of results returned by the search. In other words, this is the subset of scanned events (represented by the scanCount) that actually matches the search terms.
resultPreviewCount The number of result rows in the latest preview results.
runDuration Time in seconds that the search took to complete.
search The search string.


searchProviders A list of all the search peers that were contacted.
sid The search ID number.
statusBuckets Maximum number of timeline buckets.
  • timeline
  • field summary
  • search.log


Debug messages



By default the Search Job Inspector hides DEBUG messages. In Splunk Enterprise you can enable their display as follows: edit limits.conf and set the infocsv_log_level parameter in the [search_info] stanza to INFO.

infocsv_log_level = INFO

Examples of Search Job Inspector output


* | dedup punct




Then, command.prededup gives you the performance impact of processing the results of the search command before passing it into the dedup command. The Input count of command.prededup matches the Output count of command.search, and the Input count of command.prededup matches the Output count of command.prededup. In this case, the Output count of command.prededup should match the number of events returned at the completion of the search (which is the value of resultCount, under Search job properties).



Manage search jobs
Dispatch directory and search artifacts


Was this documentation topic helpful?





0 out of 1000 Characters