Splunk Search

Search on existing search results?

Haybuck15
Explorer

Preemptive note, I am not looking for instructions on how to run a subsearch.

 

I have results from a completed search that goes back 90 days which took an extremely long time to run. Lets say the search was:

 

 

index=foo

 

 

Now that I have those results, I need to filter them down, lets say I'd like to filter them down to:

 

 

index=foo host=bar

 

 

I'd like to search within those results without Splunk having to query the entire indexer again to reduce the amount of time the second search takes. Basically, is there any way to have Splunk query the existing, cached results already on the search head rather than having to query the indexer twice?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use loadjob.  Once the first search completes, use the Job Inspector to get the SID.  Then replace the original search with a loadjob command and add the new commands.

| loadjob 1619199687.119898 | search host=bar

Note: the ability to do this without the loadjob kludge is an old ask.  Go to https://ideas.splunk.com to add your voice.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use loadjob.  Once the first search completes, use the Job Inspector to get the SID.  Then replace the original search with a loadjob command and add the new commands.

| loadjob 1619199687.119898 | search host=bar

Note: the ability to do this without the loadjob kludge is an old ask.  Go to https://ideas.splunk.com to add your voice.

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...