What are the typical problems that are caused because the loadjob command?

[nadlurinadluri]

Hi Splunkers,

Can you let me know what are the issues with loadjob?

Lately, I see that when multiple loadjobs are used in a search through the append command, the results might be inconsistent.
Hence the question, Is loadjob an efficient way of using a cached result and load the data in dashboard faster?

There is a problem with savedsearch. My savedsearch job runs every 15th minute of an hour, and if someone opens the dashboard at that point, it will not take the previous results of the savedsearch but will wait till the current savedsearch executes.

Much appreciate the response!!

[woodcock]

The loadjob command allows you to load in the results of any previous run of any search, provided the artifacts have not been reaped, whereas the savedsearch command simply runs the SPL which is contained in another saved search. There is an XML-based way to reference the results of a search's previous run, but I like having it explicitly in the SPL, especially because the drilldown is more clear. I am unaware of any downsides to loadjob; I really like it and use it often.

[nadlurinadluri]

@woodcock thanks for the response!! I am also a regular user of loadjob, but lately I am seeing some issues with the output when I append multiple loadjobs in a single search.

[woodcock]

You are probably hitting subsearch limits. Try it like this (which is unlimited):

| loadjob ...
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]

[nadlurinadluri]

sure, will take a look !!

[woodcock]

So did it work for you, @nadlurinadluri?

[nadlurinadluri]

@woodcock @somesoni2 @MuS @niketnilay any suggestions please?