https://community.splunk.com/t5/Splunk-Search/use-case-Long-running-search-query/m-p/476567#M192644 <P>Hi, For a testing purposes, can i have few long running search SPL queries please.<BR /> Using the search tutorials sample data would be of great help.<BR /> I assume subsearches, join would be good fit for long running searches. Can you pls write some simple/basic long running SPL queries. Thx</P> Fri, 13 Sep 2019 05:06:46 GMT inventsekar 2019-09-13T05:06:46Z https://community.splunk.com/t5/Splunk-Search/use-case-Long-running-search-query/m-p/476567#M192644 <P>Hi, For a testing purposes, can i have few long running search SPL queries please.<BR /> Using the search tutorials sample data would be of great help.<BR /> I assume subsearches, join would be good fit for long running searches. Can you pls write some simple/basic long running SPL queries. Thx</P> Fri, 13 Sep 2019 05:06:46 GMT https://community.splunk.com/t5/Splunk-Search/use-case-Long-running-search-query/m-p/476567#M192644 inventsekar 2019-09-13T05:06:46Z https://community.splunk.com/t5/Splunk-Search/use-case-Long-running-search-query/m-p/476568#M192645 <P>Hi inventsekar,<BR /> use transaction and join: you'll surely have long running searches!<BR /> If you aren't still satisfied, extend the time period.<BR /> e.g.:</P> <PRE><CODE>index=wineventlog | transaction ID_accesso | join host [ search index=_internal ] </CODE></PRE> <P>(sorry for the fieldname in italian, I have only this one!)</P> <P>Bye.<BR /> Giuseppe</P> Fri, 13 Sep 2019 11:10:45 GMT https://community.splunk.com/t5/Splunk-Search/use-case-Long-running-search-query/m-p/476568#M192645 gcusello 2019-09-13T11:10:45Z