Reporting

How to run saved search command?

srowe
Explorer

Hi All,

I have been using Splunk for about 2 years now and just learned about the savedsearch command. I would LOVE to implement this as I have the need to append together a lot of search terms that are already defined in existing saved searches.

From what I've read, all I should need to do is type "| savedsearch "My Saved Search"" right? Unfortunately, that throws an error in splunk that reads:

"Error in 'SearchParser':Missing a search command before ''."

When I try without the leading pipe, I get it to run but it brings back 0 results.

Does anyone know what I'm doing wrong here? I would love to be able to use this feature. Does the saved search need to be scheduled? I also tried that with no luck, but maybe my scheduled search settings are off.

Thanks in advance, Sarah

Tags (1)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

srowe
Explorer

Wow - that worked! Thanks somesoni2! I would never have figured that out on my own.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...