loadjob
loadjob
Synopsis
Loads events or results of a previously completed search job.
Syntax
loadjob (<sid>|<savedsearch-opt>) [<result-event>] [<delegate>] [<artifact-offset>] [<ignore-running>]
Required arguments
- sid
- Syntax: <string>
- Description: The search ID of the job whose artifacts need to be loaded, for example:
1233886270.2
- savedsearch
- Syntax: savedsearch="<user-string>:<application-string>:<search-name-string>"
- Description: The unique identifier of a savedsearch whose artifacts need to be loaded. A savedsearch is uniquely identified by the triplet {user, application, savedsearch name}, for example:
savedsearch="admin:search:my saved search"
Optional arguments
- result-event
- Syntax: events=<bool>
- Description: Controls whether to load the events or the results of a job. Defaults to false (loads results).
- delegate
- Syntax: job_delegate=<string>
- Description: When specifying a savedsearch, this option selects jobs that were started by the given user. Defaults to scheduler.
- artifact-offset
- Syntax: artifact_offset=<int>
- Description: If multiple artifacts are found, this specifies which of those should be loaded. Artifacts are sorted in descending order based on the time that they were started. Defaults to 0.
- ignore_running
- Syntax: ignore_running=<bool>
- Description: Specify whether to ignore matching artifacts whose search is still running. Defaults to true.
Description
The artifacts to load are identified either by the search job id or a scheduled search name and the time range of the current search. If a savedsearch name is provided and multiple artifacts are found within that range the latest artifacts are loaded.
Examples
Example 1: Loads the results of the latest scheduled execution of savedsearch MySavedSearch in the 'search' application owned by admin
| loadjob savedsearch="admin:search:MySavedSearch"Example 2: Loads the events that were generated by the search job with id=1233886270.2
| loadjob 1233886270.2 events=tSee also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the loadjob command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.