Same query send to Splunk multiple times

[xxmazurt]

Hello,

I have an external script which sends queries to Splunk via API. My script sends 10 identical query same time. In jobs inspector, I see them as 10 different inputs. I assume that because they are run in parallel, they consume search head resources discretely.

The question is: if there is any mechanism in Splunk which could recognize that identical queries were sent to Search Head and optimize queries execution?

[s2_splunk]

I have to ask: Why does your script send 10 identical queries at the same time? What are you trying to achieve?

[woodcock]

No, but what you can do is save the search in Splunk, schedule it to run in the scheduler and then pull in the results using the loadjob command. This pulls just the results from the previous run so it uses no search resources and doesn't matter if you call it 10 times.

[jkat54]

If by optimize you mean deduplicate the 10 indentical searches into just 1 search, no there is no mechanism to do this in Splunk.

Closest option I can think of is saving a report, scheduling it to run every so often, and then pulling the results of the saved report. That would give you the same results until the report's scheduled run time came up again.