How to reuse the results of a search?

[chris]

Hi

Have you ever had the situation where you built a search that takes a while to run. And then once the output shows up you're like "Oh wow it is working - but hang on a minute I want the output to look different" and then you have to rerun the search and wait?

Is there a possibility to save the results and keep on searching on that base set?

This is what I'd like to do:
1. run a base search
2. tell Splunk to do subsequent searches on the results already found (as long as the base search remains the same)
3. add extra commands (stats/lookup) to the end of the base search
4. once I'm happy with the result, save the output and show it to my boss

Regards
Chris

[lguinn2 · Accepted solution]

Use the loadjob command. For example, let's say that you run your original search. Look under the Activity menu and select Jobs. Find the search results that you want to reuse and click Inspect. Search through the list until you find the "sid" - the search id. Use the sid in the loadjob command like this (where 123.3 is the example sid)

| loadjob 123.3 events=true | stats count by someotherfield

Instead of starting with a search, this starts by loading the events from the prior search and then you can add whatever you want to the end of the pipeline.