loadjob returns only 100 of 150 events
I have a search which returns **150 Events** but when I use the **loadjob command** I can only work with **100 Events** of the original search. Can I configure this anywhere in the splunk settings?...
View Articleloadjob or saved search to use time selector
Hi, Is there a way to get loadjob or saved search to be overridden with a time token to where it would be inline if submitted from dashboard instead of the dashboard using historical data? Or even have...
View ArticleWhy does Loadjob load oldest version of job instead of latest?
Hi, I have noticed issue that loadjob sometimes gets stale & loads oldest version of job instead of loading latest. For small interval searches, it may not be a major issue. But is certainly very...
View ArticleHow do I combine 5 searches into a single report to execute a loadjob command...
hello, In my dashboard, i use 5 different values from the search below: index="windows" sourcetype="wineventlog:Application" "SourceName=Application Error" EventCode=1000 Type=Erreur | dedup _time |...
View ArticleWhat are the typical problems that are caused because the loadjob command?
Hi Splunkers, Can you let me know what are the issues with `loadjob`? Lately, I see that when multiple loadjobs are used in a search through the append command, the results might be inconsistent. Hence...
View ArticleCan you help me with a dashboard based on reports that are filtering by time?
Hello, I created a simple dashboard with some panels taking data from the index. It was taking a long time to load, so I created a scheduled report and converted all panel queries to load data from...
View ArticleSplunk loadjob failing when using a scheduled report?
Hi, I have a scheduled report that is using loadjob and saved search stanza. It runs perfectly fine when running in a search, but when I schedule that using a scheduled report, it fails. Why and how do...
View ArticleNeed workaround- Loadjob does not work on ad hoc searches in search cluster
We currently use a single search head with an index cluster. I have written a large number of relatively complex dashboards that utilize loadjob. I recently learned, on the documentation page for the...
View ArticleCan you help me with a question about a search using the loadjob command and...
i have a saved query that can show data up to 90 days. But, when i run the search using the loadjob command, i would like to provide an option to view only 30/60/90 days data based on a users choice. I...
View ArticleImproving search performance of search powered by summary index, datamodel...
I have a panel which loads data for `last 3 months` and it takes approx 120 secs to load the single panel value - showing the count of advanced users in percentage. Currently, we have implemented the...
View ArticleIs it possible to loadjob a post-processed search?
Hi guys, Loadjob $post_process_search$ only loads $base_search$ data and not anything from the post-process search? Why? I understand it probably has something to do with how the $job.sid$ token is...
View ArticleSplunk loadjob not returning data but savedsearch does
Hello all, I am seeing a weird issue. **I am logged in as admin** and my search is saved as scheduled search. This is not giving any result: | loadjob savedsearch="admin:search:my_test_report" This is...
View ArticleFeature request: Job Manager/loadjob - Display SID and Filter on...
It would be helpful to make the SID more readily accessible. It is currently available only in the "Inspect Job" pop up windows. I regularly run somewhat long initial searches that I further winnow...
View ArticleWaiting for queued jobs for every dashboard opened
Hey all, I created 15 long run reports with big searches, I also scheduled it every month and saved those reports in 3 dashboards with each dashboard 5 reports in a panel, using below search. Now am...
View ArticleHow to load all artifact_offsets in loadjob?
Hey all! I have a saved search that runs on a schedule and generates those "artifacts", I know I can access a specific artifact offset like this `| loadjob savedsearch="my.user:search:test_search"...
View ArticleIs savedsearchjobload faster then querying index?
Is accessing results from a savedsearch via loadjob and timefilter faster or slower than from an index and what are limits?
View Articlehelp on issue between a loadjob savedsearch and a
hi I called a scheduled from my dashboard | loadjob savedsearch="admin:XX:Hardware - Battery cycle pie" | search Site=$tok_filtersite|s$ I have an issue with `| search Site=$tok_filtersite|s$` because...
View Articlehelp for catching a field in order to use it in an loadjob command
Hi In the saved search below, I retrieve the field "SITE" because I use a dropdown list in my dashboard in order to filter events by SITE | stats avg(sent_data) as sent_data avg(received_data) as...
View Articlehelp to display a timechart after a loadjob command
hello I call a timechart from a loadjob command like below and it works | loadjob savedsearch="admin:toto_sh:win timechart2" But I need to filter the events of my timechart by host because I use a text...
View ArticleError in 'SearchOperator:loadjob': Cannot find job_id 'scheduler_username_search
I'm getting this error msg when I check on View results in Splunk. Not sure why this error msg is showing up and didn't find the solution anywhere online. On Splunk, when I put a particular time range...
View Article