I run large searches at the start of each month. Generally I use the saved search commands to retrieve the results on dashboards - e.g. | savedsearch report_name. However, we sometimes use outputlookup at the end of the search and inputlookup to retrieve the data on the dashboard - e.g. | outputlookup report_file.csv.
I have recently had some issues with saved search:
jobs being deleted that causes my saved searches disappear
For saved searches to be refreshed the report needs to rescheduled and run again
Odd behaviour with reports running but data not actually being picked up by dashboards
These issues do not apply to outputlookup reports which can more easily be re-run and also can easily be edited with lookup editor if required.
Can anybody tell me which is more efficient to use and should be the default option? Are there any advantages and disadvantages to either command I have not considered?
... View more