savedsearch load results based on date range

[madhukarhebbar]

Hi ,
I am having savedsearch configuration like this.

[dailyStats]
enableSched = 1
dispatch.earliest_time =-1d@d
dispatch.latest_time = @d
cron_schedule = 0 2 * * *

which is running each day @ 2'o clock.

The above job was ran from 01Jan 2018 to 28Feb2018

Is it possible to get the report of 01Feb18 by passing parameter.?

I run loadjob savedsearch="nobody:app:dailyStats" events=false ignore_running=true artifact_offset=28 which is working fine only of there were no extra job was ran between those days and giving last 28th day of results or else it will give last 28th run of savedsearch which may not be Feb1.

My question: Is there any command to get savedsearch job by time/date?

[woodcock]

You can do this and the Timepicker value in your session will override the one in the saved search:

| savedsearch "Your Saved Search Name Here"

You can also do this:

| loadjob artifact_offset=1 savedsearch="<owner of saved search>:<app containing saved search>:<saved search name>"

The artifact_offset=1 says Don't load the last one (for this month) but the one before that (last month).

[splunker12er]

check this link can help,

https://answers.splunk.com/answers/188469/how-to-get-results-to-load-with-a-time-picker-sett.html