Reporting

Why is the loadjob command in the base search for post processing searches not working?

k_harini
Communicator

I have many post processing searches based on 1 base search. My local host is terribly slow that i cannot perform any operation. Takes more than 5 minutes to load panels. I created saved search and loaded it in base query to utilize in other searches

| loadjob savedsearch="admin:Accenture_Campaign:broadlog_search" 

I gave this with search base="global" is not working for post processing searches. How can i get this working? please help.

0 Karma
1 Solution

woodcock
Esteemed Legend

This works for me:

<dashboard>
  <label>eraseme</label>
  <search id="loadjob">
    <query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
  </search>
  <row>
    <panel>
      <table>
        <search base="loadjob">
          <query>| search host=*</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

View solution in original post

0 Karma

k_harini
Communicator

Thanks everyone for your inputs.. loadjob as base search did not work for the dropdowns. Hence the tokens were not passed to other searches. I kept getting error - "waiting for input". When i changed dropdown searches with full search command, all the post process search with load job as base search started working.

0 Karma

millarma
Path Finder

Here is how I did it. I used loadjob to call a specific report and then piped it to a search command that includes tokens

|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$

Here is what it looks like in XML Look up loadjob for more info.

<panel>
  <input type="text" token="UserName" searchWhenChanged="true">
    <label>UserName</label>
    <suffix>*</suffix>
    <default>*</default>
  </input>
  <table>
    <title>Table of Clipping and Signal to Noise Ratio activity By Group</title>
    <search>
      **<query>|loadjob savedsearch="admin:search:Table of Clipping and Signal to Noise Ratio activity By UserName" | search UserName=$UserName$</query>**
      <earliest>$earliest$</earliest>
      <latest>$latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table>
</panel>
0 Karma

woodcock
Esteemed Legend

This works for me:

<dashboard>
  <label>eraseme</label>
  <search id="loadjob">
    <query>|loadjob savedsearch=savedsearch="admin:Accenture_Campaign:broadlog_search"</query>
  </search>
  <row>
    <panel>
      <table>
        <search base="loadjob">
          <query>| search host=*</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

@woodcock what version did you use?

0 Karma

woodcock
Esteemed Legend

Splunk Version: 6.5.2
Splunk Build: 67571ef4b87d

0 Karma

DalJeanis
Legend

What is the exact error you are getting? What is the exact postsearch query?

0 Karma

sideview
SplunkTrust
SplunkTrust

If you run the loadjob command by itself, do the results have all the fields that your postprocess search requires? Also in order to get the best help, I recommend that in addition to posting the SPL of the postprocess search, also post either the SPL of the savedsearch whose job is being loaded or the list of fields that it contains.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...