Is there a way to "trigger" another search when previous saved search finished?

[leo_systex]

Is there a way to "trigger" another search when previous saved search finished?

I have a complicated jobs to run on splunk, so I separate it as two part :
One will generate a temporary lookup table , and the second one will use it.

Usually I configure them as two schedule search , and there is a buffer-time between them.
But the buffer-time is hard to decide, it depend on log volume and system performance at the execution time.
Sometime the second search run but the first search is not finish.
Sometime the first search run and rewrite the lookup table, but the previous second search is still running....
It cause wrong result for my report, and hard to trouble-shooting~

So I want to know if there any way to "trigger" another search when previous saved search finished?
So I could combined them as only one schedule job.

Or any idea to control the workflow on splunk?

[ssadh_splunk]

Have you checked the below answer:
https://answers.splunk.com/answers/614705/how-to-trigger-second-search-based-on-first-search.html

[ravicheepa]

Did you try doing same thing using Subsearchs concept.
http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Aboutsubsearches

Let me know if works for you.

[leo_systex]

Yes, I know the concept of subsearch. But there are some many limitation on subsearch ( Ex: number of return records. ) , I am processing a huge number of data, and the scenarios is not suit for subsearch.

[deepashri_123]

Hey@leo_systex,

You can use something such as load job and run your search based on the result of load job.
Refer this link:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Loadjob

Let me know if this helps!!

[leo_systex]

What I wanted is when the first search job done, "trigger" the second search job to run... How could I implement this idea by "loadjob" ?