Reporting

How do I run loadjob to get the second to last resultset?

hylam
Contributor

How do I run loadjob to get the second to last resultset? By default it gives the last resultset.

Tags (1)
1 Solution

MuS
Legend

Hi hylam,

if your saved search is named foo you can us this command:

| loadjob [ 
          search index=_audit savedsearch_name="foo" search_id='scheduler_*' 
          | sort - _time | head 2 | tail 1 
          | rename search_id AS search 
          | eval search=replace(search, "\'","") ]

What happens here? The sub search will search for the search_id of your saved searches, the sort and head and tail will get back the second last result and the rename and eval will return the values in a useable format for loadjob

Hope this helps ...

cheers, MuS

View solution in original post

splunkuseradmin
Path Finder

easiest way to get the second last result-set should be, below is the default syntax for load job.
| loadjob (sid | savedsearch) [result-event] [delegate] [artifact_offset] [ignore_running]

Selects a search artifact other than the most recent matching one. For example, if artifact_offset=1, the second most recent artifact will be used. If artifact_offset=2, the third most recent artifact will be used.
FYI= https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Loadjob

0 Karma

MuS
Legend

Hi hylam,

if your saved search is named foo you can us this command:

| loadjob [ 
          search index=_audit savedsearch_name="foo" search_id='scheduler_*' 
          | sort - _time | head 2 | tail 1 
          | rename search_id AS search 
          | eval search=replace(search, "\'","") ]

What happens here? The sub search will search for the search_id of your saved searches, the sort and head and tail will get back the second last result and the rename and eval will return the values in a useable format for loadjob

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...