splunk query slow.......

[DTERM]

Is there a way to take a query, run it in the background, save the results to a file, and then reference that file in another query? I have a few queries that take too long to run. Can I run those in the background (say maybe one or twice a day), and reference the output?

A sample query would be like....

index=whatever | top 15 hosts

A lookup table is close but that doesn't quite accomplish the objetive.

Thanks...

[ziegfried · Accepted solution]

You could use the loadjob command:

| loadjob 1346168165.751

It will emit the results of the previously executed (and saved) search.

[DTERM]

Great. Thanks!!

[sdaniels]

There are a few commands that start with the pipe and nothing before it. You'll see examples here.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchCheatsheet

[DTERM]

That sounds perfect. However, I'm confused about the pipe before the command. In the following example, what would I place before the "|" if anything?

| loadjob savedsearch="admin:search:MySavedSearch"