Reporting

Historical result of a scheduled report

sonila
Path Finder

Is anyway to find all historical results of a scheduled report in splunk? I've seen about REST and the | history command but that command shows only when that report has been scheduled but I want the results of that scheduled report. I've seen also the summary indexing case but summary indexing only collects data from that report but doesn't offer any historical links where to click and see the results.

0 Karma
1 Solution

cmerriman
Super Champion

you would need to set the expiration for the search to a set period of time (2 weeks if you only want to see two weeks of historical results of said search), and then you should be able to use |loadjob with the correct time frame of when the search ran to grab the historical results. you might be able to use it in conjunction with |history to grab the sid instead of the search name.

View solution in original post

0 Karma

cmerriman
Super Champion

you would need to set the expiration for the search to a set period of time (2 weeks if you only want to see two weeks of historical results of said search), and then you should be able to use |loadjob with the correct time frame of when the search ran to grab the historical results. you might be able to use it in conjunction with |history to grab the sid instead of the search name.

0 Karma

sonila
Path Finder

you mean that each time I make a search I need to choose the correct time frame, but this is not what i want. I want that to find all historical results for example all results grouped for each day and when I click on that day to see all events for that day. Like the triggered alerts. You can see history for triggered alerts.

0 Karma

cmerriman
Super Champion

Say you only kept 1 month of history (that's how long the expiration was). The time frame would only ever need to be one month, though you could just put all time, if you wanted. You could use the |history command or a |rest Command to get a list of sid and then the |map command with the |loadjob command to loop through all of the sid that were pulled in and bring the data back for all of them.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...