Retrieve/Re-generate SPL search and content of export

[fatsug]

Hello community

What is the most efficient way of retrieving a specific search performed or preferably, if possible, to regenerate a file (csv/pdf) export of results?

So far I have located the search/job ID and worked my way back to a search string (SPL). Though I am curious, is it possible to “re-run” the SPL snippet and just “re-generate” the file-export for inspection? Otherwise, what is the fastest and easiest way to get from search/job ID to the actual SPL search query used to generate the file export?

Best regards

// G

[PickleRick · Accepted solution]

As you have the SPL of the search, you can re-run it of course. But be aware that you might get different set of results. There can be several reasons for that (from the most obvious to the more subtle ones):

1) If the search contains any random-based values (like explicit calls to random()) or anything related to the time of the search (like calls to now()) the effective search will behave differently.

2) If the search contains any external lookups, the responses from called scripts and services can return different results

3) You might have different contents in your indexes now than you had at the time of the initial search run (some events might have been late and might have gotten indexed only after the initial search was run but also Splunk might have already evicted some buckets over retention period).

4) Your environment might have gotten some apps and add-ons updated over the time and/or ther could have been other configuration changes that affect how the events are processed, fields are extracted, dynamic fields are calculated and so on.

So you can re-run the search but you will never have 100% confidence that the results you got now are identical to the ones returned from the original search. If the artifacts from the original search already timed out and got deleted, there's no way to recreate them with full confidence. You could try analyzing your search and adjust search parameters to make sure you work over the same set of data as the initial search (probably adding some _indextime conditions, resolving manually any now() calls, verifying that the data hadn't expired and so on) but it's not that automatic and requires some serious manual fiddling.

Yes, usually the results should be more or less similar to the original ones and it's often sufficient but unless there are some other conditions fulfilled you can't say as a general rule that you can recreate the same results.

[fatsug]

Thank you @PickleRick 

Seeing it written out it all makes a lot of sense. What I can do with confidence is to regenerate the SPL executed. Anything generated/produced may not be an exact match to what was initially exported. Any results generated may or may not be similar/identical to the initial search and export.

Thank you for you detailed and clear answer, much appreciated.

// G