Splunk Search

How to load all artifact_offsets in loadjob?

New Member

Hey all! I have a saved search that runs on a schedule and generates those "artifacts", I know I can access a specific artifact offset like this

| loadjob savedsearch="my.user:search:test_search" artifact_offset=<int>
What I want is to load ALL available artifact offsets. This can be a variable amount and therefore I can't do an append.
Is there any way to do this?

0 Karma

SplunkTrust
SplunkTrust

@axelmunoz as per documentation attempt to fetch all artifacts will lead to error. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob#Optional_arguments

A value that selects past all available artifacts will result in an error.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

New Member

@niketnilay So the wording on the documentation is a little different. We don't want to select past all available artifacts, we want to select exactly all available artifacts

0 Karma