Quantcast
Channel: Questions in topic: "loadjob"
Viewing all articles
Browse latest Browse all 27

Loading base query by token

$
0
0
I'm trying to create a dashboard that does not execute the same queries multiple times. From what I have been able to find out online the way to do that is to set a token on your query so it can be loaded with the `loadjob` command. The problem I run into is that usually the `loadjob` command fails but if you try enough times it will eventually work. Even after it does work for you it will still fail randomly.> Error in 'SearchOperator:loadjob': The search artifact for job 'jdoe__jdoe__search__RMD578119c482df4f4b5_1575320222.1839344_1947AF77-263B-4511-A214-6F0DDCA0EDC5' is not available because we cannot proxy an ad-hoc job in a searchhead cluster. Please run the search locally. Here is an example dashboard to show this problem. The top panels reference the base queries by ID and you can see when those complete. The chart at the bottom tries to load both base queries by token and combine them together. This fails in the dashboard but if you click the search button on this panel to get the real search query and run it enough times it will eventually work.
-24h@hnow
index=myapp "thingOne" | eval lineSource = "Thing One"$field1.earliest$$field1.latest$$job.sid$index=myapp "thingTwo" | eval lineSource = "Thing Two"$field1.earliest$$field1.latest$$job.sid$Total of thing one | stats countTotal of thing two | stats countThings by time| loadjob "$Thing_One$" | append [ | loadjob "$Thing_Two$"] | timechart span=1h count by lineSource$earliest$$latest$

Viewing all articles
Browse latest Browse all 27

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>