Splunk Search

Splunk loadjob not returning data but savedsearch does

gagandeep_arora
Path Finder

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report
0 Karma

dm1
Contributor

did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks!

0 Karma

eugenek
Path Finder

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

0 Karma

hallt3
Path Finder

Another guess could be a permissions thing between the users / apps

0 Karma

codebuilder
Influencer

I second what eugenek suggested, it's spot on.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

eugenek
Path Finder

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...