Sending Link Once Search Completes

[David]

Is it possible to set up a dashboard that lets a user kick off a very long search, walk away, and have Splunk send an email once the search completes?

Background:
I'm writing an internal business facing app. I set up a report builder (select all the fields that you want, how do you want to split the data, how do you want to filter the data, etc.). But one of the options for what they can report on will increase the amount of time required to run the search by about 250X. I'd like to give them the option, should they so desire, of making a search that's going to take 40 minutes to complete, and getting an email once it is complete. I understand the implication of letting users DOS the server -- but is this technically possible?

[sideview]

Yes I think this is possible. Certainly you can have an arbitrarily long running search and splunk will just keep on chewing on it until it completes.

Short version:

1- either the users will have to 'save' the job by clicking 'save', or your app's javascript will have to get the job object (this.getContext().get("search").job) and call save() on it.

2- you should look into the 'sendemail' command, and explore the idea of just tacking that command onto the end of the longrunning search. You might have to turn preview off to avoid it sending lots of emails while the search is running. I'm not sure though; it might be smart enough to not do that.

Why save? --- the server has a safeguard so that if a user walks away without 'saving' the job, or clicking 'send to background' (which saves the job too), it will notice that the search became unattended and it'll actually kill it after several minutes.

So you have to 'save' it because that inoculates it from being automatically cancelled.

[David]

Ah ha. Let me explore that.