- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there!
Is there a search command that will allow me to look up results from a "saved result"? I'm looking for ways I could speed up my populating search. My populating search is taking too long to search and I was wondering if there's a way for me to have my search run before and save the results and just have my populating search read from the results. can anyone help? ~thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Sounds as if you want summary indexing, see Use summary indexing for increased reporting efficiency in the Knowledge Manager Manual: "With summary indexing, you set up a search that extracts the precise information you want, on a frequent basis. Each time Splunk runs this search it saves the results into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Although not quite the easiest command to use to instrument a dashboard (Ayn's answer is probably the most appropriate to that effect), I still want to mention the loadjob command, which does exactly what is stated in the original question : It loads up results from an existing search artifact when provided with the search ID.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks! This is what i was originally asking for. 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could also run saved searches regularly, and then load results from the last saved search. More information is available for instance here: http://splunk-base.splunk.com/answers/862/can-i-make-my-dashboards-load-faster-by-scheduling-the-sea...
And also the advanced XML module reference has information on how to use this by setting the useHistory
parameter for the relevant modules you're using. This reference is available on your Splunk server, in http(s)://splunkserver:port/modules
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Sounds as if you want summary indexing, see Use summary indexing for increased reporting efficiency in the Knowledge Manager Manual: "With summary indexing, you set up a search that extracts the precise information you want, on a frequent basis. Each time Splunk runs this search it saves the results into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks! This does sound like what I wanted, I'll look into this!
