Using results from a Loadjob and data from an index in the same search

[SeanColohan]

Hi all,

I am trying to use the results from a loadjob but to link these to data thats held in an index. I can define the loadjob entry but I cannot appear to include the index & source in the same SPL. Both the "| Loadjob" and the "index=a source=b" loads fine in a separate SPL instance

What is the best way to achieve this.

[SeanColohan]

The option of

1. index=a source=b|append [|loadjob jobname]

Worked a treat... thanks

[lfedak_splunk]

Hey @SeanColohan, if @cmerriman ♦ answered your question, please remember to "√Accept" the answer to award karma points and to let other Splunkers know it’s a working solution. We’re hosting a karma point contest, so it’s particularly awesome to up vote on Answers these days. 😄

[cmerriman · Accepted solution]

with not knowing what type of data your loadjob is resulting in, you could try something like this:

index=a source=b|append [|loadjob jobname]

you could also try using events=true in the loadjob command if it runs in verbose (I believe), to use the searches events and not results.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Loadjob