Splunk Search

splunk query slow.......

DTERM
Contributor

Is there a way to take a query, run it in the background, save the results to a file, and then reference that file in another query? I have a few queries that take too long to run. Can I run those in the background (say maybe one or twice a day), and reference the output?

A sample query would be like....

index=whatever | top 15 hosts

A lookup table is close but that doesn't quite accomplish the objetive.

Thanks...

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

You could use the loadjob command:

| loadjob 1346168165.751

It will emit the results of the previously executed (and saved) search.

View solution in original post

ziegfried
Influencer

You could use the loadjob command:

| loadjob 1346168165.751

It will emit the results of the previously executed (and saved) search.

DTERM
Contributor

Great. Thanks!!

0 Karma

sdaniels
Splunk Employee
Splunk Employee

There are a few commands that start with the pipe and nothing before it. You'll see examples here.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatsheet

0 Karma

DTERM
Contributor

That sounds perfect. However, I'm confused about the pipe before the command. In the following example, what would I place before the "|" if anything?

| loadjob savedsearch="admin:search:MySavedSearch"

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...