Reporting

Why is the loadjob command in the base search for post processing searches not working?

k_harini
Communicator

I have many post processing searches based on 1 base search. My local host is terribly slow that i cannot perform any operation. Takes more than 5 minutes to load panels. I created saved search and loaded it in base query to utilize in other searches

| loadjob savedsearch="admin:Accenture_Campaign:broadlog_search" 

I gave this with search base="global" is not working for post processing searches. How can i get this working? please help.

0 Karma
1 Solution

woodcock
Esteemed Legend

This works for me:

<dashboard>
  <label>eraseme</label>
  <search id="loadjob">
    <query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
  </search>
  <row>
    <panel>
      <table>
        <search base="loadjob">
          <query>| search host=*</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

k_harini
Communicator

Thanks everyone for your inputs.. loadjob as base search did not work for the dropdowns. Hence the tokens were not passed to other searches. I kept getting error - "waiting for input". When i changed dropdown searches with full search command, all the post process search with load job as base search started working.

0 Karma

millarma
Path Finder

Here is how I did it. I used loadjob to call a specific report and then piped it to a search command that includes tokens

|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$

Here is what it looks like in XML Look up loadjob for more info.

<panel>
  <input type="text" token="UserName" searchWhenChanged="true">
    <label>UserName</label>
    <suffix>*</suffix>
    <default>*</default>
  </input>
  <table>
    <title>Table of Clipping and Signal to Noise Ratio activity By Group</title>
    <search>
      **<query>|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$</query>**
      <earliest>$earliest$</earliest>
      <latest>$latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table>
</panel>
0 Karma

woodcock
Esteemed Legend

This works for me:

<dashboard>
  <label>eraseme</label>
  <search id="loadjob">
    <query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
  </search>
  <row>
    <panel>
      <table>
        <search base="loadjob">
          <query>| search host=*</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

@woodcock what version did you use?

0 Karma

woodcock
Esteemed Legend

Splunk Version: 6.5.2
Splunk Build: 67571ef4b87d

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

What is the exact error you are getting? What is the exact postsearch query?

0 Karma

sideview
SplunkTrust
SplunkTrust

If you run the loadjob command by itself, do the results have all the fields that your postprocess search requires? Also in order to get the best help, I recommend that in addition to posting the SPL of the postprocess search, also post either the SPL of the savedsearch whose job is being loaded or the list of fields that it contains.

0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...