Splunk Search

Cached search results

Eldad
Explorer

Hi,

I am using time consuming searches and i was wondering if and how is it possible to run the searches in advance and then access the cached search results without running the search again. I saw the saved searches option but i was not sure whether they accomplish what i am looking for.

Thanks for your help!

Tags (2)
2 Solutions

ftk
Motivator

You can use the loadjob search command to load a previous search. Keep in mind that there are default values for the time search results are kept around, and that the user's disk quota will play a part as well. Rather then replicating previous posts, have a look at the answers to this question for more info on tweaking the cache durations: http://answers.splunk.com/questions/7526/how-do-you-increase-the-duration-that-a-search-sticks-aroun...

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command.

Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Saved searches will be persisted until your quota settings rotate out the old searches based on the period settings. This is probably the most consistent way to have a search persisted and be able to load it at a future point in time. To load it in the future, you can view it through the jobs viewer in the gui or via the loadjob search command.

Note - simple dashboards that leverage scheduled saved searches will utilize the last run search. I believe the setting is called "useHistory". This may be a bit easier to use from an interface standpoint, as a user can just load that dashboard at any point in time to see the last stored result set for a given set of search results.

ftk
Motivator

You can use the loadjob search command to load a previous search. Keep in mind that there are default values for the time search results are kept around, and that the user's disk quota will play a part as well. Rather then replicating previous posts, have a look at the answers to this question for more info on tweaking the cache durations: http://answers.splunk.com/questions/7526/how-do-you-increase-the-duration-that-a-search-sticks-aroun...

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...