topic Re: How do I run loadjob to get the second to last resultset? in Reporting

How do I run loadjob to get the second to last resultset?

hylam — Sat, 12 Dec 2015 10:14:47 GMT

How do I run loadjob to get the second to last resultset? By default it gives the last resultset.

Re: How do I run loadjob to get the second to last resultset?

MuS — Sun, 13 Dec 2015 20:34:53 GMT

Hi hylam,

if your saved search is named foo you can us this command:

| loadjob [ 
          search index=_audit savedsearch_name="foo" search_id='scheduler_*' 
          | sort - _time | head 2 | tail 1 
          | rename search_id AS search 
          | eval search=replace(search, "\'","") ]

What happens here? The sub search will search for the search_id of your saved searches, the sort and head and tail will get back the second last result and the rename and eval will return the values in a useable format for loadjob

Hope this helps ...

cheers, MuS

Re: How do I run loadjob to get the second to last resultset?

splunkuseradmin — Wed, 30 Sep 2020 01:11:17 GMT

easiest way to get the second last result-set should be, below is the default syntax for load job.
| loadjob (sid | savedsearch) [result-event] [delegate] [artifact_offset] [ignore_running]

Selects a search artifact other than the most recent matching one. For example, if artifact_offset=1, the second most recent artifact will be used. If artifact_offset=2, the third most recent artifact will be used.
FYI= https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Loadjob