Splunk Search

Splunk loadjob not returning data but savedsearch does

gagandeep_arora
Path Finder

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report
0 Karma

dm1
Contributor

did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks!

0 Karma

eugenek
Path Finder

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

0 Karma

hallt3
Path Finder

Another guess could be a permissions thing between the users / apps

0 Karma

codebuilder
Influencer

I second what eugenek suggested, it's spot on.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

eugenek
Path Finder

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...