topic Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz in Reporting

Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

RiccardoV — Fri, 30 Aug 2013 10:35:52 GMT

Hi guys,
I have an issue with a saved (and scheduled) search with no result.
If I schedule a search that returns no results and I try to get it with the command

| laodjob savedsearch="admin:app:label"

Splunk returns following error:

Encountered an error while reading file '$splunk_home$/var/run/splunk/dispatch/ .... /results.csv.gz'.

If I try to change the time window where the search works (to "force" it to find some results), it works great.

How can I be sure that Splunk creates the .cvs.gz file in any case even if the search does find no results? I can not dispatch a dashboard that returns a bad error like this!

thanks 🙂

Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

Lucas_K — Mon, 16 Sep 2013 02:18:26 GMT

Add an extra line to the end of your scheduled search then 'something' will always be written regardless of the number of results obtained.

| append [|stats count |eval count="complete"| rename count as "info_search_marker" ]

You'll then need to just get rid of this line when you retrieve the results later.

| fields - info_search_marker

Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

RiccardoV — Mon, 16 Sep 2013 10:26:24 GMT

thanks A LOT! It works like a charm!
Then, you confirm that is a known issue that Splunk doesn't create a results.csv.gz file if the scheduled search returns no results?
thanks again!

Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

musskopf — Sun, 06 Jul 2014 22:19:53 GMT

I was having similar issue here, Splunk doesn't create the result file, if nothing is returned... It's a shame as only adds coding overhead on something should be straight-forward. Anyway, thanks for the tip!

Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

chanst2 — Wed, 16 Jul 2014 06:36:00 GMT

Please try to add "events=true" as an argument of the loadjob command. Splunk will not return such error even when no events returned for the savedsearch

Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

RiccardoV — Wed, 16 Jul 2014 07:18:28 GMT

thanks, I'll try asap!

Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

musskopf — Mon, 28 Sep 2020 17:06:21 GMT

Just tried now and it didn't work. Created a saved search with no results, still showing:

Encountered an error while reading file '/xxxx/splunk/dispatch/scheduler_admin_dxxxxjcmVlbg_RMD5edaa75325ad60f36_at_140999940_5127/results.csv.gz'.

Re: Saved (scheduled) searches with no results: Encountered an error while reading file results.csv.gz

chanst2 — Mon, 28 Sep 2020 17:06:29 GMT

I just tried to upload my screen shot, but too bad that my karma is <60 so that I couldn't upload.

When I issued this search command in the Splunk search bar
|loadjob events=true savedSearch="admin:xxx:yyy", I got "No results found." as a normal search without any events returned. However, when I issued |loadjob savedSearch="admin:xxx:yyy", I got "Encountered an error while reading file '/aaa/var/run/splunk/dispatch/scheduler__admin_bbb_at_1405558800_3192/results.csv.gz'."

In my case, this "events=true" works in both the search view and a dashboard panel