Search on existing search results?

Haybuck15 — Fri, 23 Apr 2021 17:25:08 GMT

Preemptive note, I am not looking for instructions on how to run a subsearch.

I have results from a completed search that goes back 90 days which took an extremely long time to run. Lets say the search was:

index=foo

Now that I have those results, I need to filter them down, lets say I'd like to filter them down to:

index=foo host=bar

I'd like to search within those results without Splunk having to query the entire indexer again to reduce the amount of time the second search takes. Basically, is there any way to have Splunk query the existing, cached results already on the search head rather than having to query the indexer twice?

Re: Search on existing search results?

richgalloway — Fri, 23 Apr 2021 17:45:26 GMT

Use loadjob. Once the first search completes, use the Job Inspector to get the SID. Then replace the original search with a loadjob command and add the new commands.

| loadjob 1619199687.119898 | search host=bar

Note: the ability to do this without the loadjob kludge is an old ask. Go to https://ideas.splunk.com to add your voice.

topic Re: Search on existing search results? in Splunk Search

Search on existing search results?

Re: Search on existing search results?