topic Re: splunk query slow....... in Splunk Search https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45588#M10831 <P>Great. Thanks!!</P> Wed, 29 Aug 2012 20:13:56 GMT DTERM 2012-08-29T20:13:56Z splunk query slow....... https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45584#M10827 <P>Is there a way to take a query, run it in the background, save the results to a file, and then reference that file in another query? I have a few queries that take too long to run. Can I run those in the background (say maybe one or twice a day), and reference the output?</P> <P>A sample query would be like....</P> <P>index=whatever | top 15 hosts</P> <P>A lookup table is close but that doesn't quite accomplish the objetive.</P> <P>Thanks...</P> Tue, 28 Aug 2012 15:03:35 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45584#M10827 DTERM 2012-08-28T15:03:35Z Re: splunk query slow....... https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45585#M10828 <P>You could use the loadjob command:</P> <PRE><CODE>| loadjob 1346168165.751 </CODE></PRE> <P>It will emit the results of the previously executed (and saved) search.</P> Tue, 28 Aug 2012 15:38:16 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45585#M10828 ziegfried 2012-08-28T15:38:16Z Re: splunk query slow....... https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45586#M10829 <P>That sounds perfect. However, I'm confused about the pipe before the command. In the following example, what would I place before the "|" if anything?</P> <P>| loadjob savedsearch="admin:search:MySavedSearch"</P> Wed, 29 Aug 2012 17:39:30 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45586#M10829 DTERM 2012-08-29T17:39:30Z Re: splunk query slow....... https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45587#M10830 <P>There are a few commands that start with the pipe and nothing before it. You'll see examples here.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatsheet">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatsheet</A></P> Wed, 29 Aug 2012 17:47:13 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45587#M10830 sdaniels 2012-08-29T17:47:13Z Re: splunk query slow....... https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45588#M10831 <P>Great. Thanks!!</P> Wed, 29 Aug 2012 20:13:56 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-slow/m-p/45588#M10831 DTERM 2012-08-29T20:13:56Z