Getting Data In

Saving Search Results

mdumka
Engager

Hello,

I am very new to Splunk. I have got it up and running on a Linux Box and analyzing some IIS logs and everything works perfect.

But my question is I saved a search with a date range of March 1 to March 31. These logs have about 2 million hits or events. It takes a long time to build.

Is there not a way once the events are scanned not to re-scan them? Just that it takes like 15 minutes every time I open the search.

Thanks

Mike

Tags (1)

I-Man
Communicator

When you saved did you hit save results or save search? It sounds like you might have done the latter which will re-populate the data every time as you are saving the search criteria instead of the results. If you save the search results even 2 million hits shouldn't take that long to come back. These options are under the Actions dropdown.

Once the results are saved you can find them in the Jobs section.

mdumka
Engager

Perfect ... Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...