Email the Scheduled Search Result

[mldaplin]

Hi, I have a search scheduled to run at a given time and alert condition to email to my colleague. When my colleague received and opened the link the search would still load and not show the result right away. I think this is kinda odd since this save search was scheduled to run so it must have already the result.

[netwrkr]

You might try using "Summary Indexing". From the man page "Use summary indexing to efficiently report on large volumes of data. With summary indexing, you set up a search that extracts the precise information you want, on a frequent basis. Each time Splunk runs this search it saves the results into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index."