Splunk Search

Can I query an already existing report?

JustRoot
Path Finder

I am looking to write an alert that would query a report I have saved that runs every day. I would like it to look for certain fields in the report and if they match, to perform an action, is this possible?

Thanks

Tags (1)
0 Karma
1 Solution

sbbadri
Motivator

try this,

| savedsearch your_report_name | fields * | .......

please check below link,

https://docs.splunk.com/Documentation/SplunkCloud/6.5.1/SearchReference/Savedsearch

View solution in original post

cmerriman
Super Champion

i would use loadjob. http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Loadjob

Loadjob will use the results from a previously ran report, just make sure your time range encompasses the entire time frame of the report. In other words, if the report was ran this morning, but covered data for the previous month, make sure that you run loadjob for the previous month to now, at least that's my experience. You also need to make sure you're saving the results long enough. If you need to access the results only every 24 hours, then you only need to save them for 24 hours.

|loadjob savedsearch="username:appname:savedsearchname" |search field1=x.....

or use |where field1=field2 or just |fields field1 field2 depending on what you're trying to accomplish, exactly.

sbbadri
Motivator

try this,

| savedsearch your_report_name | fields * | .......

please check below link,

https://docs.splunk.com/Documentation/SplunkCloud/6.5.1/SearchReference/Savedsearch

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...