Reporting
Highlighted

Why is the loadjob command in the base search for post processing searches not working?

Communicator

I have many post processing searches based on 1 base search. My local host is terribly slow that i cannot perform any operation. Takes more than 5 minutes to load panels. I created saved search and loaded it in base query to utilize in other searches

| loadjob savedsearch="admin:Accenture_Campaign:broadlog_search" 

I gave this with search base="global" is not working for post processing searches. How can i get this working? please help.

0 Karma
Highlighted

Re: Why is the loadjob command in the base search for post processing searches not working?

SplunkTrust
SplunkTrust

What is the exact error you are getting? What is the exact postsearch query?

0 Karma
Highlighted

Re: Why is the loadjob command in the base search for post processing searches not working?

SplunkTrust
SplunkTrust

If you run the loadjob command by itself, do the results have all the fields that your postprocess search requires? Also in order to get the best help, I recommend that in addition to posting the SPL of the postprocess search, also post either the SPL of the savedsearch whose job is being loaded or the list of fields that it contains.

0 Karma
Highlighted

Re: Why is the loadjob command in the base search for post processing searches not working?

Esteemed Legend

This works for me:

<dashboard>
  <label>eraseme</label>
  <search id="loadjob">
    <query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
  </search>
  <row>
    <panel>
      <table>
        <search base="loadjob">
          <query>| search host=*</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma
Highlighted

Re: Why is the loadjob command in the base search for post processing searches not working?

SplunkTrust
SplunkTrust

@woodcock what version did you use?

0 Karma
Highlighted

Re: Why is the loadjob command in the base search for post processing searches not working?

Esteemed Legend

Splunk Version: 6.5.2
Splunk Build: 67571ef4b87d

0 Karma
Highlighted

Re: Why is the loadjob command in the base search for post processing searches not working?

Communicator

Thanks everyone for your inputs.. loadjob as base search did not work for the dropdowns. Hence the tokens were not passed to other searches. I kept getting error - "waiting for input". When i changed dropdown searches with full search command, all the post process search with load job as base search started working.

0 Karma
Highlighted

Re: Why is the loadjob command in the base search for post processing searches not working?

Explorer

Here is how I did it. I used loadjob to call a specific report and then piped it to a search command that includes tokens

|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$

Here is what it looks like in XML Look up loadjob for more info.

<panel>
  <input type="text" token="UserName" searchWhenChanged="true">
    <label>UserName</label>
    <suffix>*</suffix>
    <default>*</default>
  </input>
  <table>
    <title>Table of Clipping and Signal to Noise Ratio activity By Group</title>
    <search>
      **<query>|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$</query>**
      <earliest>$earliest$</earliest>
      <latest>$latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table>
</panel>
0 Karma