Reporting

can we get the previous results of scheduled report?

chaitanya1996
Engager

Hello splunkers,

I have report scheduled to run 0 minutes past every hour to generate the tabular results for last 60 minutes and send the email including the link to results.

report has successfully sent the email (at 00:00,01:00,........,10:00, 11:00, 12:00.....23:00)

If i access the link to results at 12:10 in the email that was generated at 10:00, i am able to see the latest results only (i.e., results generated at 12:00, even though i am clicking on the previous link).

Can anyone please help me how can i check the results that are generated at that particular time range by clicking the link in respective email.

Labels (1)
0 Karma

codebuilder
SplunkTrust
SplunkTrust

This is especially easy if you have the SID (and it hasn't expired).
Simply use loadjob and pass in the SID:

loadjob <SID>

You can also load results using the saved search name:

loadjob savedsearch="admin:search:MySavedSearch"
----
An upvote would be appreciated and Accept Solution if it helps!

codebuilder
SplunkTrust
SplunkTrust

You can also add in "artifact_offset" when using saved search name, which allows you to go back in time on the runs (one older than the newest, e.g.).

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Loadjob

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

jkat54
SplunkTrust
SplunkTrust

I think that by default splunk only keeps the last 2 scheduled executions of any saved search.

See this link for how to adjust it:

https://docs.splunk.com/Documentation/Splunk/8.0.1/Search/Extendjoblifetimes

manjunathmeti
SplunkTrust
SplunkTrust

is the results link contains sid? Please post a sample URL.

0 Karma

chaitanya1996
Engager
0 Karma

to4kawa
Ultra Champion

you should change Trigger Actions , include Search String.

you can choose any time picker.

0 Karma

chaitanya1996
Engager

@to4kawa As i mentioned it is scheduled report, my issue is not with the alert.
In splunk 6.6.3 v i cannot find Add to triggered alerts.
can we check the past results for scheduled report mail, as we are able to do so in alert mail.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...