Reporting

savedsearch load results based on date range

madhukarhebbar
Engager

Hi ,
I am having savedsearch configuration like this.

[dailyStats]
enableSched = 1
dispatch.earliest_time =-1d@d
dispatch.latest_time = @d
cron_schedule = 0 2 * * *

which is running each day @ 2'o clock.

The above job was ran from 01Jan 2018 to 28Feb2018

Is it possible to get the report of 01Feb18 by passing parameter.?

I run loadjob savedsearch="nobody:app:dailyStats" events=false ignore_running=true artifact_offset=28 which is working fine only of there were no extra job was ran between those days and giving last 28th day of results or else it will give last 28th run of savedsearch which may not be Feb1.

My question: Is there any command to get savedsearch job by time/date?

0 Karma

woodcock
Esteemed Legend

You can do this and the Timepicker value in your session will override the one in the saved search:

| savedsearch "Your Saved Search Name Here"

You can also do this:

| loadjob artifact_offset=1 savedsearch="<owner of saved search>:<app containing saved search>:<saved search name>"

The artifact_offset=1 says Don't load the last one (for this month) but the one before that (last month).

0 Karma

splunker12er
Motivator
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...