https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103790#M26827 <P>Sounds as if you want summary indexing, see <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usesummaryindexing">Use summary indexing for increased reporting efficiency</A> in the Knowledge Manager Manual: "With summary indexing, you set up a search that extracts the precise information you want, on a frequent basis. Each time Splunk runs this search it saves the results into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index."</P> Thu, 19 Jul 2012 17:28:19 GMT ChrisG 2012-07-19T17:28:19Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103789#M26826 <P>Hi there!</P> <P>Is there a search command that will allow me to look up results from a "saved result"? I'm looking for ways I could speed up my populating search. My populating search is taking too long to search and I was wondering if there's a way for me to have my search run before and save the results and just have my populating search read from the results. can anyone help? ~thanks!</P> Thu, 19 Jul 2012 17:16:49 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103789#M26826 monicato 2012-07-19T17:16:49Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103790#M26827 <P>Sounds as if you want summary indexing, see <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Usesummaryindexing">Use summary indexing for increased reporting efficiency</A> in the Knowledge Manager Manual: "With summary indexing, you set up a search that extracts the precise information you want, on a frequent basis. Each time Splunk runs this search it saves the results into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index."</P> Thu, 19 Jul 2012 17:28:19 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103790#M26827 ChrisG 2012-07-19T17:28:19Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103791#M26828 <P>Thanks! This does sound like what I wanted, I'll look into this!</P> Thu, 19 Jul 2012 18:17:31 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103791#M26828 monicato 2012-07-19T18:17:31Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103792#M26829 <P>You could also run saved searches regularly, and then load results from the last saved search. More information is available for instance here: <A href="http://splunk-base.splunk.com/answers/862/can-i-make-my-dashboards-load-faster-by-scheduling-the-searches">http://splunk-base.splunk.com/answers/862/can-i-make-my-dashboards-load-faster-by-scheduling-the-searches</A></P> <P>And also the advanced XML module reference has information on how to use this by setting the <CODE>useHistory</CODE> parameter for the relevant modules you're using. This reference is available on your Splunk server, in http(s)://splunkserver:port/modules</P> Thu, 19 Jul 2012 18:48:40 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103792#M26829 Ayn 2012-07-19T18:48:40Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103793#M26830 <P>Although not quite the easiest command to use to instrument a dashboard (Ayn's answer is probably the most appropriate to that effect), I still want to mention the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob">loadjob</A> command, which does exactly what is stated in the original question : It loads up results from an existing search artifact when provided with the search ID.</P> Thu, 19 Jul 2012 18:56:23 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103793#M26830 hexx 2012-07-19T18:56:23Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103794#M26831 <P>Thanks! This is what i was originally asking for. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 20 Jul 2012 16:50:47 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-search-command-to-look-up-results-from-saved-results/m-p/103794#M26831 monicato 2012-07-20T16:50:47Z