Reporting

Using results from a Loadjob and data from an index in the same search

SeanColohan
New Member

Hi all,

I am trying to use the results from a loadjob but to link these to data thats held in an index. I can define the loadjob entry but I cannot appear to include the index & source in the same SPL. Both the "| Loadjob" and the "index=a source=b" loads fine in a separate SPL instance

What is the best way to achieve this.

0 Karma
1 Solution

cmerriman
Super Champion

with not knowing what type of data your loadjob is resulting in, you could try something like this:

index=a source=b|append [|loadjob jobname]

you could also try using events=true in the loadjob command if it runs in verbose (I believe), to use the searches events and not results.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Loadjob

View solution in original post

0 Karma

SeanColohan
New Member

The option of

  1. index=a source=b|append [|loadjob jobname]

Worked a treat... thanks

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @SeanColohan, if @cmerriman ♦ answered your question, please remember to "√Accept" the answer to award karma points and to let other Splunkers know it’s a working solution. We’re hosting a karma point contest, so it’s particularly awesome to up vote on Answers these days. 😄

0 Karma

cmerriman
Super Champion

with not knowing what type of data your loadjob is resulting in, you could try something like this:

index=a source=b|append [|loadjob jobname]

you could also try using events=true in the loadjob command if it runs in verbose (I believe), to use the searches events and not results.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Loadjob

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!