topic Getting Error while using Saved Search in Correlation search in Splunk ITSI

Getting Error while using Saved Search in Correlation search

bmssathish — Mon, 14 Oct 2019 09:48:34 GMT

Hi,

I am trying to use Saved search as ad-hoc querry while creating correlation search. But getting below error while saving it. could anyone pls help ?

"Invalid search string: Error in 'savedsearch' command: Unable to find saved search named 'XXX-XXX-XXXX'.."

Thanks

Re: Getting Error while using Saved Search in Correlation search

szhou_splunk — Wed, 23 Oct 2019 00:02:13 GMT

Hi, would you check if the saved search 'XXX-XXX-XXXX' exists and enabled, and accessible by ITSI? You can test the correlation search string by click "Run Search" before saving the correlation search.

Re: Getting Error while using Saved Search in Correlation search

bmssathish — Sun, 03 Nov 2019 13:48:59 GMT

Hi, Yes saved search is available and i am able to "Run Search" before saving it but getting error only while saving it.