After I've upgraded splunk from 4.1.5 to 4.2.1,some of the saved searches encountered errors now,while some are ok.
Error message:
Error in 'file' command: You have insufficient privileges to perform this operation.
[SimpleResultsTable module] Server reported HTTP status=400 while getting mode=results <?xml version='1.0' encoding='UTF-8'?> <response><messages><msg type='FATAL'>Error in 'file' command: You have insufficient privileges to perform this operation.</msg></messages></response>
The file
command was deprecated as of 4.1.x, and finally removed in 4.2. You can use inputcsv or inputlookups to replace it in many cases.