Reporting

can we get the previous results of scheduled report?

chaitanya1996
Engager

Hello splunkers,

I have report scheduled to run 0 minutes past every hour to generate the tabular results for last 60 minutes and send the email including the link to results.

report has successfully sent the email (at 00:00,01:00,........,10:00, 11:00, 12:00.....23:00)

If i access the link to results at 12:10 in the email that was generated at 10:00, i am able to see the latest results only (i.e., results generated at 12:00, even though i am clicking on the previous link).

Can anyone please help me how can i check the results that are generated at that particular time range by clicking the link in respective email.

Labels (1)
0 Karma

codebuilder
Influencer

This is especially easy if you have the SID (and it hasn't expired).
Simply use loadjob and pass in the SID:

loadjob <SID>

You can also load results using the saved search name:

loadjob savedsearch="admin:search:MySavedSearch"
----
An upvote would be appreciated and Accept Solution if it helps!

codebuilder
Influencer

You can also add in "artifact_offset" when using saved search name, which allows you to go back in time on the runs (one older than the newest, e.g.).

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Loadjob

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

jkat54
SplunkTrust
SplunkTrust

I think that by default splunk only keeps the last 2 scheduled executions of any saved search.

See this link for how to adjust it:

https://docs.splunk.com/Documentation/Splunk/8.0.1/Search/Extendjoblifetimes

manjunathmeti
Champion

is the results link contains sid? Please post a sample URL.

0 Karma

chaitanya1996
Engager
0 Karma

to4kawa
SplunkTrust
SplunkTrust

you should change Trigger Actions , include Search String.

you can choose any time picker.

0 Karma

chaitanya1996
Engager

@to4kawa As i mentioned it is scheduled report, my issue is not with the alert.
In splunk 6.6.3 v i cannot find Add to triggered alerts.
can we check the past results for scheduled report mail, as we are able to do so in alert mail.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!