Splunk Search

How can I save a query data so that it does not get loaded everytime

webnair
Explorer

I would like to save a query result, for example: for a particular month. I don't want splunk to load the page and fetch the data everytime the page is loaded.

I need to get the results saved so that I can see the results instantaneously.Similar to canned report.

Tags (2)

jimodonald
Contributor

You could schedule your search to run once a month and output to a CSV. Subsequent searches can pull the data from the monthly CSV.

richgalloway
SplunkTrust
SplunkTrust

Musskopf's comment is a good suggestion. You might also consider saving the query resuls in a summary index and pulling from the index to load the page.

---
If this reply helps you, Karma would be appreciated.

musskopf
Builder

You'll need to save your search as a report and schedule the report to run. Once it ran at least once, use the command " |loadjob "admin:search:report_name" " to get the results...

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...