Splunk Search

How to reuse the results of a search?

chris
Motivator

Hi

Have you ever had the situation where you built a search that takes a while to run. And then once the output shows up you're like "Oh wow it is working - but hang on a minute I want the output to look different" and then you have to rerun the search and wait?

Is there a possibility to save the results and keep on searching on that base set?

This is what I'd like to do:
1. run a base search
2. tell Splunk to do subsequent searches on the results already found (as long as the base search remains the same)
3. add extra commands (stats/lookup) to the end of the base search
4. once I'm happy with the result, save the output and show it to my boss

Regards
Chris

0 Karma
1 Solution

lguinn2
Legend

Use the loadjob command. For example, let's say that you run your original search. Look under the Activity menu and select Jobs. Find the search results that you want to reuse and click Inspect. Search through the list until you find the "sid" - the search id. Use the sid in the loadjob command like this (where 123.3 is the example sid)

| loadjob 123.3 events=true | stats count by someotherfield

Instead of starting with a search, this starts by loading the events from the prior search and then you can add whatever you want to the end of the pipeline.

View solution in original post

lguinn2
Legend

Use the loadjob command. For example, let's say that you run your original search. Look under the Activity menu and select Jobs. Find the search results that you want to reuse and click Inspect. Search through the list until you find the "sid" - the search id. Use the sid in the loadjob command like this (where 123.3 is the example sid)

| loadjob 123.3 events=true | stats count by someotherfield

Instead of starting with a search, this starts by loading the events from the prior search and then you can add whatever you want to the end of the pipeline.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...