Hello splunkers,
I have report scheduled to run 0 minutes past every hour to generate the tabular results for last 60 minutes and send the email including the link to results.
report has successfully sent the email (at 00:00,01:00,........,10:00, 11:00, 12:00.....23:00)
If i access the link to results at 12:10 in the email that was generated at 10:00, i am able to see the latest results only (i.e., results generated at 12:00, even though i am clicking on the previous link).
Can anyone please help me how can i check the results that are generated at that particular time range by clicking the link in respective email.
This is especially easy if you have the SID (and it hasn't expired).
Simply use loadjob and pass in the SID:
loadjob <SID>
You can also load results using the saved search name:
loadjob savedsearch="admin:search:MySavedSearch"
You can also add in "artifact_offset" when using saved search name, which allows you to go back in time on the runs (one older than the newest, e.g.).
https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Loadjob
I think that by default splunk only keeps the last 2 scheduled executions of any saved search.
See this link for how to adjust it:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Search/Extendjoblifetimes
is the results link contains sid? Please post a sample URL.
yes @manjunathmeti. Sample url is here: "http://localhost:8000/app//@go?sid=scheduler__admin_WFczX1NPQ19MNTNI__tablereport_at_1581055200_142&..."
you should change Trigger Actions , include Search String.
you can choose any time picker.
@to4kawa As i mentioned it is scheduled report, my issue is not with the alert.
In splunk 6.6.3 v i cannot find Add to triggered alerts.
can we check the past results for scheduled report mail, as we are able to do so in alert mail.