Reporting

What are the typical problems that are caused because the loadjob command?

nadlurinadluri
Communicator

Hi Splunkers,

Can you let me know what are the issues with loadjob?

Lately, I see that when multiple loadjobs are used in a search through the append command, the results might be inconsistent.
Hence the question, Is loadjob an efficient way of using a cached result and load the data in dashboard faster?

There is a problem with savedsearch. My savedsearch job runs every 15th minute of an hour, and if someone opens the dashboard at that point, it will not take the previous results of the savedsearch but will wait till the current savedsearch executes.

Much appreciate the response!!

Tags (2)
0 Karma

woodcock
Esteemed Legend

The loadjob command allows you to load in the results of any previous run of any search, provided the artifacts have not been reaped, whereas the savedsearch command simply runs the SPL which is contained in another saved search. There is an XML-based way to reference the results of a search's previous run, but I like having it explicitly in the SPL, especially because the drilldown is more clear. I am unaware of any downsides to loadjob; I really like it and use it often.

0 Karma

nadlurinadluri
Communicator

@woodcock thanks for the response!! I am also a regular user of loadjob, but lately I am seeing some issues with the output when I append multiple loadjobs in a single search.

0 Karma

woodcock
Esteemed Legend

You are probably hitting subsearch limits. Try it like this (which is unlimited):

| loadjob ...
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]
| appendpipe [| loadjob ...]

nadlurinadluri
Communicator

sure, will take a look !!

0 Karma

woodcock
Esteemed Legend

So did it work for you, @nadlurinadluri?

0 Karma

nadlurinadluri
Communicator

@woodcock @somesoni2 @MuS @niketnilay any suggestions please?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...