Splunk Search

How can I save a query data so that it does not get loaded everytime

webnair
Explorer

I would like to save a query result, for example: for a particular month. I don't want splunk to load the page and fetch the data everytime the page is loaded.

I need to get the results saved so that I can see the results instantaneously.Similar to canned report.

Tags (2)

jimodonald
Contributor

You could schedule your search to run once a month and output to a CSV. Subsequent searches can pull the data from the monthly CSV.

richgalloway
SplunkTrust
SplunkTrust

Musskopf's comment is a good suggestion. You might also consider saving the query resuls in a summary index and pulling from the index to load the page.

---
If this reply helps you, Karma would be appreciated.

musskopf
Builder

You'll need to save your search as a report and schedule the report to run. Once it ran at least once, use the command " |loadjob "admin:search:report_name" " to get the results...

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...