Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- What are the typical problems that are caused beca...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What are the typical problems that are caused because the loadjob command?
Hi Splunkers,
Can you let me know what are the issues with loadjob?
Lately, I see that when multiple loadjobs are used in a search through the append command, the results might be inconsistent.
Hence the question, Is loadjob an efficient way of using a cached result and load the data in dashboard faster?
There is a problem with savedsearch. My savedsearch job runs every 15th minute of an hour, and if someone opens the dashboard at that point, it will not take the previous results of the savedsearch but will wait till the current savedsearch executes.
Much appreciate the response!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The loadjob command allows you to load in the results of any previous run of any search, provided the artifacts have not been reaped, whereas the savedsearch command simply runs the SPL which is contained in another saved search. There is an XML-based way to reference the results of a search's previous run, but I like having it explicitly in the SPL, especially because the drilldown is more clear. I am unaware of any downsides to loadjob; I really like it and use it often.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock thanks for the response!! I am also a regular user of loadjob, but lately I am seeing some issues with the output when I append multiple loadjobs in a single search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are probably hitting subsearch limits. Try it like this (which is unlimited):
| loadjob ...
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sure, will take a look !!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So did it work for you, @nadlurinadluri?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock @somesoni2 @MuS @niketnilay any suggestions please?
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
