topic Re: Saving Search Results in Getting Data In

Saving Search Results

mdumka — Wed, 13 Apr 2011 22:26:45 GMT

Hello,

I am very new to Splunk. I have got it up and running on a Linux Box and analyzing some IIS logs and everything works perfect.

But my question is I saved a search with a date range of March 1 to March 31. These logs have about 2 million hits or events. It takes a long time to build.

Is there not a way once the events are scanned not to re-scan them? Just that it takes like 15 minutes every time I open the search.

Thanks

Mike

Re: Saving Search Results

I-Man — Wed, 13 Apr 2011 22:40:00 GMT

When you saved did you hit save results or save search? It sounds like you might have done the latter which will re-populate the data every time as you are saving the search criteria instead of the results. If you save the search results even 2 million hits shouldn't take that long to come back. These options are under the Actions dropdown.

Once the results are saved you can find them in the Jobs section.

Re: Saving Search Results

mdumka — Thu, 14 Apr 2011 04:25:32 GMT

Perfect ... Thanks!