splunkd.log
09-23-2014 19:17:05.101 +0000 ERROR SearchOperator:savedsplunk - Error in 'savedsearch' command: Unable to find saved search named 'ADSCV_SSP_REQUESTS'.
Running the command
| savedsearch ADSCV_SSP_REQUESTS
Gives me a UI error
Error in 'savedsearch' command: Unable to find saved search named 'ADSCV_SSP_REQUESTS'.
The saved search is scheduled under the same user trying to run the saved search command. The saved search has read access to all roles. The saved search is shared at the app level in the search app. What is causing this error?
Ben - can you ensure that the savedsearch in question is not Disabled? This would cause the above error.
i am facing error when running : hostname:port/services/search/jobs/export end point through postman
Input : search%3D%7C%20savedsearch%20MySavedSearch
Output :
<messages>
<msg type="FATAL">Empty search.</msg>
</messages>
Same saved search is running in web successfully.
Ben - can you ensure that the savedsearch in question is not Disabled? This would cause the above error.
Turns out that the search was disabled due to type. Had a default stanza in between a saved search, causing all of the underlying searches that was owned by the user to be disabled.
The saved search is shared at the app level, with read access to all roles. Other roles can run the | savedsearch command without getting the error.
I have ran the saved search command using an admin role user and was successful. I created a new account with the same role as the user that owns this search and has it scheduled. It also ran successful. Running it as the owner seems to be causing the error.
Please let me know how I can get this resolved.