Hello,
Is it possible to run a savedsearch once a first savedsearch has finished running?
I have a savedsearch which runs a script which will collect data and I would like to have this data display once collected. So I would like to have the second savedsearch to display the result once the first search has finished running.
Thanks for your help!
Cyril
You run your 2nd saved search from your script itself, in the end, using Splunk CLI OR REST API endpoint using curl.
Run search using Splunk CLI: http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/CLIsearchsyntax
Run search using curl-Rest API : http://answers.splunk.com/answers/8945/how-to-start-a-saved-search-using-rest-api.html
Thanks, I will try to add the search on the script. Would it work if after that using the command | loadjob ?
I don't see a reason why it'll not run.