Splunk Search

call save results from view

chandansingh
Explorer

Hi every one , i would like to call saved results of splunk in view xml.so i can show saved results to user instead of latest search. please help on same.

Tags (1)
2 Solutions

David
Splunk Employee
Splunk Employee

I would take a look at the answer to this question:

http://answers.splunk.com/questions/8079/cached-search-results

Specifically, the loadjob search command, or the useHistory option. Alternatively, you can always use summary indexing:

http://www.splunk.com/wiki/Deploy:Summary_Indexing

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you just want to send a specific set of results to someone, just go to:

Actions > Get link to results

That saves the search results (saves the "job" technically) and it gives you a URL that you can copy and paste elsewhere, to view those exact results later. Once a job is saved it wont be deleted by splunkd.

If on the other hand you want a dashboard to always show some relatively recent results rather than always running the search each time the user loads the dashboard, then you want to

a) save the search as a 'saved search'

b) set the dashboard to run from that saved search instead of an inline search string

(You may well have done these steps already)

c) in that saved search, turn on the scheduling options, and set it to run every hour or every day etc.

Once you do that, (and once the schedule has generated at least one job), that dashboard panel will always show the most recently run results for the search instead of running the search on demand.

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you just want to send a specific set of results to someone, just go to:

Actions > Get link to results

That saves the search results (saves the "job" technically) and it gives you a URL that you can copy and paste elsewhere, to view those exact results later. Once a job is saved it wont be deleted by splunkd.

If on the other hand you want a dashboard to always show some relatively recent results rather than always running the search each time the user loads the dashboard, then you want to

a) save the search as a 'saved search'

b) set the dashboard to run from that saved search instead of an inline search string

(You may well have done these steps already)

c) in that saved search, turn on the scheduling options, and set it to run every hour or every day etc.

Once you do that, (and once the schedule has generated at least one job), that dashboard panel will always show the most recently run results for the search instead of running the search on demand.

David
Splunk Employee
Splunk Employee

I would take a look at the answer to this question:

http://answers.splunk.com/questions/8079/cached-search-results

Specifically, the loadjob search command, or the useHistory option. Alternatively, you can always use summary indexing:

http://www.splunk.com/wiki/Deploy:Summary_Indexing

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...