I have a saved search that I scheduled to run every night, since the search takes a few minutes to run and I view the data infrequently. I will typically pull up last night's results with the "View Recent" link inside the Saved Searches area, but then I don't know of an easy way to filter the job results further without rerunning the expensive search.
I believe there is syntax to run a search command on a completed job by job id, but I want to run a search command on the latest search, and the latest job id will change. Ideally, I'd like to be able to get fast results from:
{results of most recent search 'Foo'} | search app_name=my_app
What is the best strategy/syntax to accomplish this?
... View more