<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How can I get a result of saved search with loadjob in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78711#M19918</link>
    <description>&lt;P&gt;Where the result of the loaded job will be display ?&lt;/P&gt;</description>
    <pubDate>Thu, 17 Sep 2015 10:20:07 GMT</pubDate>
    <dc:creator>SirHill17</dc:creator>
    <dc:date>2015-09-17T10:20:07Z</dc:date>
    <item>
      <title>How can I get a result of saved search with loadjob</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78709#M19916</link>
      <description>&lt;P&gt;How can I get a result of saved search with loadjob&lt;/P&gt;

&lt;P&gt;I'm confused with loadjob. &lt;/P&gt;

&lt;P&gt;I have a saved search called "Splunk error last 24 hours". I wanted to see the search result I ran last time from command line. &lt;/P&gt;

&lt;P&gt;$ ./splunk search '| loadjob savedsearch="admin:search:Splunk error last 24 hours"' -auth admin:changeme&lt;/P&gt;

&lt;P&gt;I thought loadjob can do it. But, the loadjob does not give me search result. &lt;BR /&gt;
Oh, by the way, this saved search is not scheduled right now. So, I'm testing it manually. &lt;BR /&gt;
What is wrong? &lt;/P&gt;</description>
      <pubDate>Sat, 25 Feb 2012 08:33:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78709#M19916</guid>
      <dc:creator>Masa</dc:creator>
      <dc:date>2012-02-25T08:33:56Z</dc:date>
    </item>
    <item>
      <title>Re: How can I get a result of saved search with loadjob</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78710#M19917</link>
      <description>&lt;P&gt;If the saved search is a scheduled saved search, your command should work. &lt;/P&gt;

&lt;P&gt;If the saved search is not a scheduled search, and you're looking for the artifact which was run by a user, admin, you need an option job_delegate=admin. &lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;&lt;BR /&gt;
 ./bin/splunk search '| loadjob savedsearch="admin:search:Splunk errors last 24 hours" job_delegate=admin'&lt;BR /&gt;
&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Sat, 25 Feb 2012 08:34:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78710#M19917</guid>
      <dc:creator>Masa</dc:creator>
      <dc:date>2012-02-25T08:34:27Z</dc:date>
    </item>
    <item>
      <title>Re: How can I get a result of saved search with loadjob</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78711#M19918</link>
      <description>&lt;P&gt;Where the result of the loaded job will be display ?&lt;/P&gt;</description>
      <pubDate>Thu, 17 Sep 2015 10:20:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78711#M19918</guid>
      <dc:creator>SirHill17</dc:creator>
      <dc:date>2015-09-17T10:20:07Z</dc:date>
    </item>
    <item>
      <title>Re: How can I get a result of saved search with loadjob</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78712#M19919</link>
      <description>&lt;P&gt;This is run from Splunk CLI, so it will be shown on the command windows (if run directly) OR in stdout if running from script.&lt;/P&gt;</description>
      <pubDate>Thu, 17 Sep 2015 13:53:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-result-of-saved-search-with-loadjob/m-p/78712#M19919</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2015-09-17T13:53:51Z</dc:date>
    </item>
  </channel>
</rss>

