I have many post processing searches based on 1 base search. My local host is terribly slow that i cannot perform any operation. Takes more than 5 minutes to load panels. I created saved search and loaded it in base query to utilize in other searches
| loadjob savedsearch="admin:Accenture_Campaign:broadlog_search"
I gave this with search base="global"
is not working for post processing searches. How can i get this working? please help.
This works for me:
<dashboard>
<label>eraseme</label>
<search id="loadjob">
<query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
</search>
<row>
<panel>
<table>
<search base="loadjob">
<query>| search host=*</query>
</search>
</table>
</panel>
</row>
</dashboard>
Thanks everyone for your inputs.. loadjob as base search did not work for the dropdowns. Hence the tokens were not passed to other searches. I kept getting error - "waiting for input". When i changed dropdown searches with full search command, all the post process search with load job as base search started working.
Here is how I did it. I used loadjob to call a specific report and then piped it to a search command that includes tokens
|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$
Here is what it looks like in XML Look up loadjob for more info.
<panel>
<input type="text" token="UserName" searchWhenChanged="true">
<label>UserName</label>
<suffix>*</suffix>
<default>*</default>
</input>
<table>
<title>Table of Clipping and Signal to Noise Ratio activity By Group</title>
<search>
**<query>|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$</query>**
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
This works for me:
<dashboard>
<label>eraseme</label>
<search id="loadjob">
<query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
</search>
<row>
<panel>
<table>
<search base="loadjob">
<query>| search host=*</query>
</search>
</table>
</panel>
</row>
</dashboard>
@woodcock what version did you use?
Splunk Version: 6.5.2
Splunk Build: 67571ef4b87d
What is the exact error you are getting? What is the exact postsearch query?
If you run the loadjob command by itself, do the results have all the fields that your postprocess search requires? Also in order to get the best help, I recommend that in addition to posting the SPL of the postprocess search, also post either the SPL of the savedsearch whose job is being loaded or the list of fields that it contains.