loadjob
Use the loadjob operator to load events or results of a previously completed search job query.
Syntax
|loadjob job_id [ignore_running=bool]
<job_id>
|
The search ID of the job whose artifacts need to be loaded. For example |
|
|
Optional. Skips over artifacts whose search is still running. By default, this is set to |
Usage
The loadjob operator can be used for a variety of purposes. For example, you can issue a fairly expensive search and then calculate and display relevant statistics.
Examples
The following command will display results of job with id 68e22574dafb45ce92937f2094f2d21d:
Example 1: Load results from a previously completed search job.
|loadjob 68e22574dafb45ce92937f2094f2d21d ignore_running=trueControlling truncation in search
To improve the speed of searches, Security Analytics truncates the output of each search by default. For example, if the full output set is 10,000 events, the loadjob operator returns only a truncated portion of those results.