Splunk Search

Does splunk> do any internal caching of recent searches?

tylr
Engager

Does splunk> do any internal caching of recent searches?

More to the point...

Can I be 100% certain that my search results are "fresh" and not a cached result from a (very) recent identical search?

Even if there was no new data indexed in-between those sequential identical searches?

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

In the default search UI, as long as you hit return in the searchbar, or you click the green button, or you change the timerange, it will definitely submit a new search.

In fact unless you explicitly save the results (actions > save results, or 'get link to results'), it will explicitly cancel and destroy the previous search right before submitting the new one.

If that doesnt give you a 100% feeling, I can just attest that no, there's no mechanism for any kind of "cleverness". Submit the search and you get a new search running in splunkd.

If you're ever curious you can use 'get link to results' to see the search Ids, or you can watch the parade of search ids in the Jobs page as you do all this. Open up 'Jobs' in the upper right and then periodically refresh it while you run different searches.

View solution in original post

sideview
SplunkTrust
SplunkTrust

In the default search UI, as long as you hit return in the searchbar, or you click the green button, or you change the timerange, it will definitely submit a new search.

In fact unless you explicitly save the results (actions > save results, or 'get link to results'), it will explicitly cancel and destroy the previous search right before submitting the new one.

If that doesnt give you a 100% feeling, I can just attest that no, there's no mechanism for any kind of "cleverness". Submit the search and you get a new search running in splunkd.

If you're ever curious you can use 'get link to results' to see the search Ids, or you can watch the parade of search ids in the Jobs page as you do all this. Open up 'Jobs' in the upper right and then periodically refresh it while you run different searches.

gkanapathy
Splunk Employee
Splunk Employee

No, it generally does not, though if you are using dashboards that reference scheduled saved searches, the dashboards may use stored results, and of course the loadjob command will fetch back previous search results as that it what it is meant to do.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...