Hi all,
I am trying to use the results from a loadjob but to link these to data thats held in an index. I can define the loadjob entry but I cannot appear to include the index & source in the same SPL. Both the "| Loadjob" and the "index=a source=b" loads fine in a separate SPL instance
What is the best way to achieve this.
with not knowing what type of data your loadjob is resulting in, you could try something like this:
index=a source=b|append [|loadjob jobname]
you could also try using events=true
in the loadjob command if it runs in verbose (I believe), to use the searches events and not results.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Loadjob
The option of
Worked a treat... thanks
Hey @SeanColohan, if @cmerriman ♦ answered your question, please remember to "√Accept" the answer to award karma points and to let other Splunkers know it’s a working solution. We’re hosting a karma point contest, so it’s particularly awesome to up vote on Answers these days. 😄
with not knowing what type of data your loadjob is resulting in, you could try something like this:
index=a source=b|append [|loadjob jobname]
you could also try using events=true
in the loadjob command if it runs in verbose (I believe), to use the searches events and not results.
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Loadjob