Getting Data In

How do I filter or search on the results of a long running scheduled search job?

jkeglovitz
Explorer

I have a saved search that I scheduled to run every night, since the search takes a few minutes to run and I view the data infrequently. I will typically pull up last night's results with the "View Recent" link inside the Saved Searches area, but then I don't know of an easy way to filter the job results further without rerunning the expensive search.

I believe there is syntax to run a search command on a completed job by job id, but I want to run a search command on the latest search, and the latest job id will change. Ideally, I'd like to be able to get fast results from:

{results of most recent search 'Foo'} | search app_name=my_app

What is the best strategy/syntax to accomplish this?

Tags (2)
0 Karma

Simeon
Splunk Employee
Splunk Employee

If you save the search, you can leverage the loadjob command to use the result set of a previously run search:

http://www.splunk.com/base/Documentation/latest/SearchReference/Loadjob

For example:

| loadjob savedsearch="admin:search:MySavedSearch"

jkeglovitz
Explorer

When I try to use loadjob savedsearch="Foo", I get an error message: "The saved search Foo cannot run as part of a search as it contains non search commands. Please use the savedsearch command." Is loadjob the wrong approach?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

you can also provide the SID of the job instead of the name, which you can find (for example) in the URL when you click through to the job results from the job manager.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...