Understanding Search - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 39

The App menu, Owner menu, Status menu, and search bar let you filter what jobs
are displayed.
The table has the following columns:
• Dispatched at is the time at which the search started.
• Owner is the user that started the job. Sometimes jobs will appear with
system as the user if the saved search is configured in an application but not
owned by a particular user.
• Application specifies the application in which the search was started. This is
useful for locating your searches as well as unfamiliar searches being fired off
by other apps.
• Size is the amount of disk space being used to store the results of this query.
• Events shows the number of events that were matched by the search. In a
complicated search or report, the results returned may be different from this
number.
• Run time is how long a search took to run or the elapsed time if the search is
still running.
• Expires is the time at which the results will be removed from disk.
• Status lets you see and sort searches based on whether they are still running.
One simple way to find running jobs is to change the Status
menu to Running and click the magnifying glass.
• Actions provides the following links to affect a search or its results:
° Inspect shows detailed information about the query. We will
cover the search job inspector in Chapter 5 , Advanced Search Examples .
° Save keeps the search results indefinitely.
° Pause pauses the execution of a job.
° Finalize stops the execution but keeps the results located up to
this point.
° Delete removes the results from the disk immediately. It is generally
not necessary to delete search results as they will expire on their own.
• The search bar at the top of this window is useful for finding present and
past jobs.