Reporting

What are the typical problems that are caused because the loadjob command?

Communicator

Hi Splunkers,

Can you let me know what are the issues with loadjob?

Lately, I see that when multiple loadjobs are used in a search through the append command, the results might be inconsistent.
Hence the question, Is loadjob an efficient way of using a cached result and load the data in dashboard faster?

There is a problem with savedsearch. My savedsearch job runs every 15th minute of an hour, and if someone opens the dashboard at that point, it will not take the previous results of the savedsearch but will wait till the current savedsearch executes.

Much appreciate the response!!

Tags (2)
0 Karma

Esteemed Legend

The loadjob command allows you to load in the results of any previous run of any search, provided the artifacts have not been reaped, whereas the savedsearch command simply runs the SPL which is contained in another saved search. There is an XML-based way to reference the results of a search's previous run, but I like having it explicitly in the SPL, especially because the drilldown is more clear. I am unaware of any downsides to loadjob; I really like it and use it often.

0 Karma

Communicator

@woodcock thanks for the response!! I am also a regular user of loadjob, but lately I am seeing some issues with the output when I append multiple loadjobs in a single search.

0 Karma

Esteemed Legend

You are probably hitting subsearch limits. Try it like this (which is unlimited):

| loadjob ...
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]

Communicator

sure, will take a look !!

0 Karma

Esteemed Legend

So did it work for you, @nadlurinadluri?

0 Karma

Communicator

@woodcock @somesoni2 @MuS @niketnilay any suggestions please?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!