SPLUNK JOIN MAX SOFTWARE

To improve the speed of searches, Splunk software truncates search results by default. A search head cluster runs searches on results or artifacts that the search head cluster replicates.įor more information on artifact replication, see Search head clustering architecture in the Distributed Search manual. You can use loadjob searches to display those statistics for further aggregation, categorization, field selection and other manipulations for charting and display.Īfter a search job has completed and the results are cached, you can use this command to access or load the results.Ī search head cluster can run the loadjob command only on scheduled saved searches. The loadjob command can be used for a variety of purposes, but one of the most useful is to run a fairly expensive search that calculates statistics. Generating commands use a leading pipe character and should be the first command in a search. The loadjob command is an event-generating command. Default: true result_event Syntax: events= Description: events=true loads events, while events=false loads results. Defaults: scheduler ignore_running Syntax: ignore_running= Description: Skip over artifacts whose search is still running. Dashboard-embedded searches are run in accordance with the saved search's dispatchAs parameter, typically the owner of the search. Scheduled jobs will be run by the delegate 'scheduler'. Default: 0 delegate Syntax: job_delegate= Description: When specifying a saved search, this option selects jobs that were started by the given user. A value that selects past all available artifacts will result in an error. If artifact_offset=0, selects the most recent. If artifact_offset=2, the third most recent artifact will be used. For example, if artifact_offset=1, the second most recent artifact will be used. Optional arguments artifact_offset Syntax: artifact_offset= Description: Selects a search artifact other than the most recent matching one. All portions of the triplet must be provided. A saved search is uniquely identified by the triplet, for example: savedsearch='admin:search:my Saved Search' There is no method to specify a wildcard or match-all behavior. savedsearch Syntax: savedsearch='::' Description: The unique identifier of a saved search whose artifacts need to be loaded. You can locate the sid through the Job Inspector or the addinfo command. Sid Syntax: Description: The search ID of the job whose artifacts need to be loaded, for example: 1233886270.2. You must specify either sid or savedsearch. You cannot run the loadjob command on real-time searches. If a saved search name is provided and multiple artifacts are found within that range, the latest artifacts are loaded. The artifacts to load are identified either by the search job id or a scheduled search name and the time range of the current search. Loads events or results of a previously completed search job.

Splunk join max