Does splunk> do any internal caching of recent searches?

[tylr]

Does splunk> do any internal caching of recent searches?

More to the point...

Can I be 100% certain that my search results are "fresh" and not a cached result from a (very) recent identical search?

Even if there was no new data indexed in-between those sequential identical searches?

[sideview · Accepted solution]

In the default search UI, as long as you hit return in the searchbar, or you click the green button, or you change the timerange, it will definitely submit a new search.

In fact unless you explicitly save the results (actions > save results, or 'get link to results'), it will explicitly cancel and destroy the previous search right before submitting the new one.

If that doesnt give you a 100% feeling, I can just attest that no, there's no mechanism for any kind of "cleverness". Submit the search and you get a new search running in splunkd.

If you're ever curious you can use 'get link to results' to see the search Ids, or you can watch the parade of search ids in the Jobs page as you do all this. Open up 'Jobs' in the upper right and then periodically refresh it while you run different searches.

[gkanapathy]

No, it generally does not, though if you are using dashboards that reference scheduled saved searches, the dashboards may use stored results, and of course the loadjob command will fetch back previous search results as that it what it is meant to do.