So, I created at savedsearch and it was working fine. But I had to change the SPL for it and I tried it again, and it is still showing the old results and not showing the new SPL changes. Why? Do I have to wait for the changes t happen?
Where is it showing the same results? Is it a scheduled saved search and you are looking at recent results? Is it a saved search you run manually or from a dashboard?
It is also from both a manual search and a dashboard.
It is showing when I do | loadjob savedsearch="username:search:data_need"
It was scheduled... I change it thinking it would fix it... but it did not.
If you use loadjob, it always loads an existing, previously run job.
If you run
| savedsearch ...
then it will run a new search. If that new search returns the wrong results, then it would seem likely that the search has not changed