topic Re: Extend Search without re-running in Splunk Search

Extend Search without re-running

thepocketwade — Tue, 12 Oct 2010 21:17:22 GMT

I just ran a search over the last 24 hours which returned a large number of results, but not the full picture I was looking for. So I extended the time frame to the last 7 days. Doing that reran the whole search, including the results I'd already amassed over the last 24 hours.

I could feasibly open a new window and run the search over 6 days, and have the two sets of results to work with; but is there a way to concatenate these results together?

Re: Extend Search without re-running

gkanapathy — Tue, 12 Oct 2010 21:46:23 GMT

Well, I suppose you could use a combination of the append and loadjob commands.

newsearch | append [ loadjob oldsearchid ]

Re: Extend Search without re-running

christopherutz — Tue, 12 Oct 2010 22:34:57 GMT

This seems very useful. In what methods can the old search id be obtained? I know it can be retrieved from the jobs view but are there any other ways? Does the jobid end up as a field of the results?

Re: Extend Search without re-running

thepocketwade — Tue, 12 Oct 2010 22:56:04 GMT

From the actions menu you can select "Inspect Search." The search inspector window will pop up, and you can find a lot of information (including the search id) there.

Re: Extend Search without re-running

landen99 — Fri, 07 Mar 2014 15:34:33 GMT

Found the sid as the last element in the url while the search was loaded/started.