topic Cached search results in Splunk Search

Cached search results

Eldad — Tue, 19 Oct 2010 18:05:42 GMT

Hi,

I am using time consuming searches and i was wondering if and how is it possible to run the searches in advance and then access the cached search results without running the search again. I saw the saved searches option but i was not sure whether they accomplish what i am looking for.

Thanks for your help!

Re: Cached search results

ftk — Tue, 19 Oct 2010 20:06:01 GMT

You can use the loadjob search command to load a previous search. Keep in mind that there are default values for the time search results are kept around, and that the user's disk quota will play a part as well. Rather then replicating previous posts, have a look at the answers to this question for more info on tweaking the cache durations: http://answers.splunk.com/questions/7526/how-do-you-increase-the-duration-that-a-search-sticks-around-the-server

Re: Cached search results

Simeon — Wed, 20 Oct 2010 06:55:26 GMT

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command.

Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.