https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320160#M7242 <P>Hello,</P> <P>I have an external script which sends queries to Splunk via API. My script sends 10 identical query same time. In jobs inspector, I see them as 10 different inputs. I assume that because they are run in parallel, they consume search head resources discretely.</P> <P>The question is: if there is any mechanism in Splunk which could recognize that identical queries were sent to Search Head and optimize queries execution?</P> Thu, 07 Sep 2017 10:21:41 GMT xxmazurt 2017-09-07T10:21:41Z https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320160#M7242 <P>Hello,</P> <P>I have an external script which sends queries to Splunk via API. My script sends 10 identical query same time. In jobs inspector, I see them as 10 different inputs. I assume that because they are run in parallel, they consume search head resources discretely.</P> <P>The question is: if there is any mechanism in Splunk which could recognize that identical queries were sent to Search Head and optimize queries execution?</P> Thu, 07 Sep 2017 10:21:41 GMT https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320160#M7242 xxmazurt 2017-09-07T10:21:41Z https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320161#M7243 <P>If by optimize you mean deduplicate the 10 indentical searches into just 1 search, no there is no mechanism to do this in Splunk.</P> <P>Closest option I can think of is saving a report, scheduling it to run every so often, and then pulling the results of the saved report. That would give you the same results until the report's scheduled run time came up again.</P> Thu, 07 Sep 2017 11:28:33 GMT https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320161#M7243 jkat54 2017-09-07T11:28:33Z https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320162#M7244 <P>No, but what you can do is save the search in Splunk, schedule it to run in the scheduler and then pull in the results using the <CODE>loadjob</CODE> command. This pulls just the results from the previous run so it uses no search resources and doesn't matter if you call it 10 times.</P> Thu, 07 Sep 2017 12:18:29 GMT https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320162#M7244 woodcock 2017-09-07T12:18:29Z https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320163#M7245 <P>I have to ask: Why does your script send 10 identical queries at the same time? What are you trying to achieve?</P> Thu, 07 Sep 2017 17:25:46 GMT https://community.splunk.com/t5/Splunk-Enterprise/Same-query-send-to-Splunk-multiple-times/m-p/320163#M7245 s2_splunk 2017-09-07T17:25:46Z