Splunk Search

Cached search results

Eldad
Explorer

Hi,

I am using time consuming searches and i was wondering if and how is it possible to run the searches in advance and then access the cached search results without running the search again. I saw the saved searches option but i was not sure whether they accomplish what i am looking for.

Thanks for your help!

Tags (2)
2 Solutions

ftk
Motivator

You can use the loadjob search command to load a previous search. Keep in mind that there are default values for the time search results are kept around, and that the user's disk quota will play a part as well. Rather then replicating previous posts, have a look at the answers to this question for more info on tweaking the cache durations: http://answers.splunk.com/questions/7526/how-do-you-increase-the-duration-that-a-search-sticks-aroun...

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command.

Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command.

Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

ftk
Motivator

You can use the loadjob search command to load a previous search. Keep in mind that there are default values for the time search results are kept around, and that the user's disk quota will play a part as well. Rather then replicating previous posts, have a look at the answers to this question for more info on tweaking the cache durations: http://answers.splunk.com/questions/7526/how-do-you-increase-the-duration-that-a-search-sticks-aroun...

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...