How do I filter or search on the results of a long running scheduled search job?

[jkeglovitz]

I have a saved search that I scheduled to run every night, since the search takes a few minutes to run and I view the data infrequently. I will typically pull up last night's results with the "View Recent" link inside the Saved Searches area, but then I don't know of an easy way to filter the job results further without rerunning the expensive search.

I believe there is syntax to run a search command on a completed job by job id, but I want to run a search command on the latest search, and the latest job id will change. Ideally, I'd like to be able to get fast results from:

{results of most recent search 'Foo'} | search app_name=my_app

What is the best strategy/syntax to accomplish this?

[Simeon]

If you save the search, you can leverage the loadjob command to use the result set of a previously run search:

http://www.splunk.com/base/Documentation/latest/SearchReference/Loadjob

For example:

| loadjob savedsearch="admin:search:MySavedSearch"

[jkeglovitz]

When I try to use loadjob savedsearch="Foo", I get an error message: "The saved search Foo cannot run as part of a search as it contains non search commands. Please use the savedsearch command." Is loadjob the wrong approach?

[gkanapathy]

you can also provide the SID of the job instead of the name, which you can find (for example) in the URL when you click through to the job results from the job manager.