Splunk® Enterprise

Search Reference

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF



Loads events or results of a previously completed search job. The artifacts to load are identified either by the search job id <sid> or a scheduled search name and the time range of the current search. If a saved search name is provided and multiple artifacts are found within that range, the latest artifacts are loaded.

You cannot run the loadjob command on ad hoc or real-time searches.


The required syntax is in bold.

| loadjob
(<sid> | <savedsearch>)

Required arguments

You must specify either sid or savedsearch.

Syntax: <string>
Description: The search ID of the job whose artifacts need to be loaded, for example: 1233886270.2. You can locate the sid through the Job Inspector or the addinfo command.
Syntax: savedsearch="<user-string>:<app-string>:<search-name-string>"
Description: The unique identifier of a saved search whose artifacts need to be loaded. A saved search is uniquely identified by the triplet {user, app, savedsearch name}, for example: savedsearch="admin:search:my Saved Search" There is no method to specify a wildcard or match-all behavior. All portions of the triplet must be provided.

Optional arguments

Syntax: artifact_offset=<int>
Description: Selects a search artifact other than the most recent matching one. For example, if artifact_offset=1, the second most recent artifact will be used. If artifact_offset=2, the third most recent artifact will be used. If artifact_offset=0, selects the most recent. A value that selects past all available artifacts will result in an error.
Default: 0
Syntax: job_delegate=<string>
Description: When specifying a saved search, this option selects jobs that were started by the given user. Scheduled jobs will be run by the delegate "scheduler". Dashboard-embedded searches are run in accordance with the saved search's dispatchAs parameter, typically the owner of the search.
Defaults: scheduler
Syntax: ignore_running=<bool>
Description: Skip over artifacts whose search is still running.
Default: true
Syntax: events=<bool>
Description: events=true loads events, while events=false loads results.
Default: false


The loadjob command is an event-generating command. See Command types.

Generating commands use a leading pipe character and should be the first command in a search.

The loadjob command can be used for a variety of purposes, but one of the most useful is to run a fairly expensive search that calculates statistics. You can use loadjob searches to display those statistics for further aggregation, categorization, field selection and other manipulations for charting and display.

After a search job has completed and the results are cached, you can use this command to access or load the results.

Search head clusters

A search head cluster can run the loadjob command only on scheduled saved searches. A search head cluster runs searches on results or artifacts that the search head cluster replicates.

For more information on artifact replication, see Search head clustering architecture in the Distributed Search manual.


1. Load the results of a saved search

Loads the results of the latest scheduled execution of saved search MySavedSearch in the 'search' application owned by the user admin.

| loadjob savedsearch="admin:search:MySavedSearch"

2. Specifying a saved search with a space in the name

Loads the results of the latest scheduled execution of saved search Potential Threats in the 'search' application owned by the user maria.

| loadjob savedsearch="maria:search:Potential Threats"

3. Load the results from a specific search job

Loads the events that were generated by the search job with id=1233886270.2.

| loadjob 1233886270.2 events=true

See also

Related information
Manage search jobs
Last modified on 04 January, 2023

This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.8, 7.1.7, 7.0.0, 7.3.7, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 7.3.9, 8.0.0, 8.0.1

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters