Splunk Search

Cached search results

Eldad
Explorer

Hi,

I am using time consuming searches and i was wondering if and how is it possible to run the searches in advance and then access the cached search results without running the search again. I saw the saved searches option but i was not sure whether they accomplish what i am looking for.

Thanks for your help!

Tags (2)
2 Solutions

ftk
Motivator

You can use the loadjob search command to load a previous search. Keep in mind that there are default values for the time search results are kept around, and that the user's disk quota will play a part as well. Rather then replicating previous posts, have a look at the answers to this question for more info on tweaking the cache durations: http://answers.splunk.com/questions/7526/how-do-you-increase-the-duration-that-a-search-sticks-aroun...

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command.

Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command.

Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

View solution in original post

ftk
Motivator

You can use the loadjob search command to load a previous search. Keep in mind that there are default values for the time search results are kept around, and that the user's disk quota will play a part as well. Rather then replicating previous posts, have a look at the answers to this question for more info on tweaking the cache durations: http://answers.splunk.com/questions/7526/how-do-you-increase-the-duration-that-a-search-sticks-aroun...

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!