Splunk Search
Highlighted

Subsearch using loadjob not working

Communicator

I try the following search:

| loadjob savedsearch="admin:app1:app1_view1" | fields hostname

This returns "hostname05" as a result.

I then try to embed this as a subsearch:

| loadjob savedsearch="admin:winapp:perfmon_results" | search object=Processor counter="% Processor Time" [| loadjob savedsearch="admin:app1:app1_view1" | fields hostname]

This return no results, however, if I do this:

   | loadjob savedsearch="admin:winapp:perfmon_results" | search object=Processor counter="% Processor Time" hostname="hostname05"

It returns many results. Why is the subsearch not working? Do I need to call loadjob differently? I've tried with and without the initial pipe.

Tags (2)
0 Karma
Highlighted

Re: Subsearch using loadjob not working

SplunkTrust
SplunkTrust

Try this.

| loadjob savedsearch="admin:winapp:perfmon_results" | search object=Processor counter="% Processor Time" [| loadjob savedsearch="admin:app1:app1_view1" | fields hostname | format "" "" "" "" "" ""]
0 Karma
Highlighted

Re: Subsearch using loadjob not working

Contributor

Subsearch calling loadjob does not work. You get "Error in 'SearchOperator:loadjob': Cannot find artifacts for savedsearchident 'user:app:savedsearchname'.
Here is the query I used:
| loadjob savedsearch="user:app:saved
searchname1" | append [| loadjob savedsearch="user:app:savedsearchname_2"]

0 Karma