Reporting

Why is the loadjob command in the base search for post processing searches not working?

k_harini
Communicator

I have many post processing searches based on 1 base search. My local host is terribly slow that i cannot perform any operation. Takes more than 5 minutes to load panels. I created saved search and loaded it in base query to utilize in other searches

| loadjob savedsearch="admin:Accenture_Campaign:broadlog_search" 

I gave this with search base="global" is not working for post processing searches. How can i get this working? please help.

0 Karma
1 Solution

woodcock
Esteemed Legend

This works for me:

<dashboard>
  <label>eraseme</label>
  <search id="loadjob">
    <query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
  </search>
  <row>
    <panel>
      <table>
        <search base="loadjob">
          <query>| search host=*</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

k_harini
Communicator

Thanks everyone for your inputs.. loadjob as base search did not work for the dropdowns. Hence the tokens were not passed to other searches. I kept getting error - "waiting for input". When i changed dropdown searches with full search command, all the post process search with load job as base search started working.

0 Karma

millarma
Path Finder

Here is how I did it. I used loadjob to call a specific report and then piped it to a search command that includes tokens

|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$

Here is what it looks like in XML Look up loadjob for more info.

<panel>
  <input type="text" token="UserName" searchWhenChanged="true">
    <label>UserName</label>
    <suffix>*</suffix>
    <default>*</default>
  </input>
  <table>
    <title>Table of Clipping and Signal to Noise Ratio activity By Group</title>
    <search>
      **<query>|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$</query>**
      <earliest>$earliest$</earliest>
      <latest>$latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table>
</panel>
0 Karma

woodcock
Esteemed Legend

This works for me:

<dashboard>
  <label>eraseme</label>
  <search id="loadjob">
    <query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
  </search>
  <row>
    <panel>
      <table>
        <search base="loadjob">
          <query>| search host=*</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

@woodcock what version did you use?

0 Karma

woodcock
Esteemed Legend

Splunk Version: 6.5.2
Splunk Build: 67571ef4b87d

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

What is the exact error you are getting? What is the exact postsearch query?

0 Karma

sideview
SplunkTrust
SplunkTrust

If you run the loadjob command by itself, do the results have all the fields that your postprocess search requires? Also in order to get the best help, I recommend that in addition to posting the SPL of the postprocess search, also post either the SPL of the savedsearch whose job is being loaded or the list of fields that it contains.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...