Reporting

Historical result of a scheduled report

sonila
Path Finder

Is anyway to find all historical results of a scheduled report in splunk? I've seen about REST and the | history command but that command shows only when that report has been scheduled but I want the results of that scheduled report. I've seen also the summary indexing case but summary indexing only collects data from that report but doesn't offer any historical links where to click and see the results.

0 Karma
1 Solution

cmerriman
Super Champion

you would need to set the expiration for the search to a set period of time (2 weeks if you only want to see two weeks of historical results of said search), and then you should be able to use |loadjob with the correct time frame of when the search ran to grab the historical results. you might be able to use it in conjunction with |history to grab the sid instead of the search name.

View solution in original post

0 Karma

cmerriman
Super Champion

you would need to set the expiration for the search to a set period of time (2 weeks if you only want to see two weeks of historical results of said search), and then you should be able to use |loadjob with the correct time frame of when the search ran to grab the historical results. you might be able to use it in conjunction with |history to grab the sid instead of the search name.

0 Karma

sonila
Path Finder

you mean that each time I make a search I need to choose the correct time frame, but this is not what i want. I want that to find all historical results for example all results grouped for each day and when I click on that day to see all events for that day. Like the triggered alerts. You can see history for triggered alerts.

0 Karma

cmerriman
Super Champion

Say you only kept 1 month of history (that's how long the expiration was). The time frame would only ever need to be one month, though you could just put all time, if you wanted. You could use the |history command or a |rest Command to get a list of sid and then the |map command with the |loadjob command to loop through all of the sid that were pulled in and bring the data back for all of them.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...