Splunk Search

Using loadjob in a packaged app

splunked38
Communicator

We're creating an app which uses loadjob, however loadjob requires 

savedsearch="<owner>:<app>:<saved search name>"


In the app, the other fields are ok but the owner would need to change as you move from testing the app (with a named account) to nobody within the packaged app

Is there a way to use loadjob within an app without hardcoding owner:app:savedsearch , use dynamic variables or avoid loadjob altogether with an alternative?

BTW: why loadjob? long running report and it is running as a subsearch using a different time range to main search making this a scheduled report

Labels (1)
Tags (2)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!