Knowledge Management

How to load scheduled real time search using their search id or search name?

splunker9999
Path Finder

HI,

We are looking to enhance our real time dashboard performance, in away of that we have scheduled real time searches and expecting to load this searches by their triggered time .

Is their a way we can load real time scheduled searches?

Thanks

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Not sure if changing it to a scheduled real-time dashboard would really enhance the performance. Real-time searches are very expensive and should be avoided. You could use a regular saved search, executed at frequent interval and load the result of search in your dashboard.

0 Karma

jensonthottian
Contributor

you can get sid using -| rest /services/search/jobs count=0 | search isDone=1 isSavedSearch=1 | table label sid

| loadjob $sid$

normally an sid look like this - search_id='scheduler_nobody_U3BsdW5rX1NBX0NJTQ_RMD5eddd0618b168fff8_at_1457648640_1115'

1457648640 -is the epoch execution time , use a token to be passed to convert your time into epoch and append that to sid.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...