Splunk Search
Highlighted

Does splunk> do any internal caching of recent searches?

Engager

Does splunk> do any internal caching of recent searches?

More to the point...

Can I be 100% certain that my search results are "fresh" and not a cached result from a (very) recent identical search?

Even if there was no new data indexed in-between those sequential identical searches?

Tags (3)
Highlighted

Re: Does splunk> do any internal caching of recent searches?

Splunk Employee
Splunk Employee

No, it generally does not, though if you are using dashboards that reference scheduled saved searches, the dashboards may use stored results, and of course the loadjob command will fetch back previous search results as that it what it is meant to do.

Highlighted

Re: Does splunk> do any internal caching of recent searches?

SplunkTrust
SplunkTrust

In the default search UI, as long as you hit return in the searchbar, or you click the green button, or you change the timerange, it will definitely submit a new search.

In fact unless you explicitly save the results (actions > save results, or 'get link to results'), it will explicitly cancel and destroy the previous search right before submitting the new one.

If that doesnt give you a 100% feeling, I can just attest that no, there's no mechanism for any kind of "cleverness". Submit the search and you get a new search running in splunkd.

If you're ever curious you can use 'get link to results' to see the search Ids, or you can watch the parade of search ids in the Jobs page as you do all this. Open up 'Jobs' in the upper right and then periodically refresh it while you run different searches.

View solution in original post