loadjob
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
loadjob
Synopsis
Loads events or results of a previously completed search job.
Syntax
loadjob (sid-opt|savedsearch-opt) [result-event-opt]
Arguments
- sid-opt
- Syntax:
- Description:
- savedsearch-opt
- Syntax:
- Description:
- result-event-opt
- Syntax:
- Description:
Description
The artifacts to load are identified either by the search job id or a scheduled search name and the time range of the current search. If a savedsearch name is provided and multiple artifacts are found within that range the latest artifacts are loaded.
Examples
Example 1: Loads the results of the latest scheduled execution of savedsearch MySavedSearch in the 'search' application owned by admin
| loadjob savedsearch="admin:search:MySavedSearch"Example 2: Loads the events that were generated by the search job with id=1233886270.2
| loadjob 1233886270.2 events=t
See also
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.