Splunk Search

Using loadjob in a packaged app

splunked38
Communicator

We're creating an app which uses loadjob, however loadjob requires 

savedsearch="<owner>:<app>:<saved search name>"


In the app, the other fields are ok but the owner would need to change as you move from testing the app (with a named account) to nobody within the packaged app

Is there a way to use loadjob within an app without hardcoding owner:app:savedsearch , use dynamic variables or avoid loadjob altogether with an alternative?

BTW: why loadjob? long running report and it is running as a subsearch using a different time range to main search making this a scheduled report

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...