Getting Data In

How do I filter or search on the results of a long running scheduled search job?

jkeglovitz
Explorer

I have a saved search that I scheduled to run every night, since the search takes a few minutes to run and I view the data infrequently. I will typically pull up last night's results with the "View Recent" link inside the Saved Searches area, but then I don't know of an easy way to filter the job results further without rerunning the expensive search.

I believe there is syntax to run a search command on a completed job by job id, but I want to run a search command on the latest search, and the latest job id will change. Ideally, I'd like to be able to get fast results from:

{results of most recent search 'Foo'} | search app_name=my_app

What is the best strategy/syntax to accomplish this?

Tags (2)
0 Karma

Simeon
Splunk Employee
Splunk Employee

If you save the search, you can leverage the loadjob command to use the result set of a previously run search:

http://www.splunk.com/base/Documentation/latest/SearchReference/Loadjob

For example:

| loadjob savedsearch="admin:search:MySavedSearch"

jkeglovitz
Explorer

When I try to use loadjob savedsearch="Foo", I get an error message: "The saved search Foo cannot run as part of a search as it contains non search commands. Please use the savedsearch command." Is loadjob the wrong approach?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

you can also provide the SID of the job instead of the name, which you can find (for example) in the URL when you click through to the job results from the job manager.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...