Can you let me know what are the issues with
Lately, I see that when multiple loadjobs are used in a search through the append command, the results might be inconsistent.
Hence the question, Is loadjob an efficient way of using a cached result and load the data in dashboard faster?
There is a problem with savedsearch. My savedsearch job runs every 15th minute of an hour, and if someone opens the dashboard at that point, it will not take the previous results of the savedsearch but will wait till the current savedsearch executes.
Much appreciate the response!!
loadjob command allows you to load in the results of any previous run of any search, provided the artifacts have not been reaped, whereas the
savedsearch command simply runs the SPL which is contained in another saved search. There is an XML-based way to reference the results of a search's previous run, but I like having it explicitly in the SPL, especially because the drilldown is more clear. I am unaware of any downsides to
loadjob; I really like it and use it often.
You are probably hitting subsearch limits. Try it like this (which is unlimited):
| loadjob ... | appendpipe [| loadjob ...] | appendpipe [| loadjob ...] | appendpipe [| loadjob ...] | appendpipe [| loadjob ...] | appendpipe [| loadjob ...]