Getting Data In

How do I filter or search on the results of a long running scheduled search job?

jkeglovitz
Explorer

I have a saved search that I scheduled to run every night, since the search takes a few minutes to run and I view the data infrequently. I will typically pull up last night's results with the "View Recent" link inside the Saved Searches area, but then I don't know of an easy way to filter the job results further without rerunning the expensive search.

I believe there is syntax to run a search command on a completed job by job id, but I want to run a search command on the latest search, and the latest job id will change. Ideally, I'd like to be able to get fast results from:

{results of most recent search 'Foo'} | search app_name=my_app

What is the best strategy/syntax to accomplish this?

Tags (2)
0 Karma

Simeon
Splunk Employee
Splunk Employee

If you save the search, you can leverage the loadjob command to use the result set of a previously run search:

http://www.splunk.com/base/Documentation/latest/SearchReference/Loadjob

For example:

| loadjob savedsearch="admin:search:MySavedSearch"

jkeglovitz
Explorer

When I try to use loadjob savedsearch="Foo", I get an error message: "The saved search Foo cannot run as part of a search as it contains non search commands. Please use the savedsearch command." Is loadjob the wrong approach?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

you can also provide the SID of the job instead of the name, which you can find (for example) in the URL when you click through to the job results from the job manager.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...