Reporting

Why does Loadjob load oldest version of job instead of latest?

stanwin
Contributor

Hi,

I have noticed issue that loadjob sometimes gets stale & loads oldest version of job instead of loading latest.

For small interval searches, it may not be a major issue. But is certainly very dubious when you have search spanning last 24 hours etc.

Splunk Enterprise Version: 7.1.1 & Build: 8f0ead9ec3db with SHC

Is this fixed in a newer version or has it been raised a a bug already?

This was an issue in past with version 6.4.4 & seems to have cropped up again!

Nothing here: https://docs.splunk.com/Documentation/Splunk/7.1.2/ReleaseNotes/KnownIssues

stanwin
Contributor

As a workaround I am using rest to load the most recent completed job

 | loadjob
[| rest splunk_server=local /servicesNS/nobody/cyberdyneApp/saved/searches/schedule_T101_deploy_past/history 
  |  search isDone=1 | sort - published | table title | head 1 | return $title] 

bandit
Motivator

Thanks for the workaround @stanwin

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...