topic Re: Saved Search showing old data? in Reporting

Saved Search showing old data?

sumarri — Mon, 15 Apr 2024 21:40:39 GMT

So, I created at savedsearch and it was working fine. But I had to change the SPL for it and I tried it again, and it is still showing the old results and not showing the new SPL changes. Why? Do I have to wait for the changes t happen?

Re: Saved Search showing old data?

bowesmana — Mon, 15 Apr 2024 23:04:16 GMT

Where is it showing the same results? Is it a scheduled saved search and you are looking at recent results? Is it a saved search you run manually or from a dashboard?

Re: Saved Search showing old data?

sumarri — Tue, 16 Apr 2024 11:43:43 GMT

It is showing when I do | loadjob savedsearch="username:search:data_need"

It was scheduled... I change it thinking it would fix it... but it did not.

Re: Saved Search showing old data?

sumarri — Tue, 16 Apr 2024 11:46:42 GMT

It is also from both a manual search and a dashboard.

Re: Saved Search showing old data?

bowesmana — Wed, 17 Apr 2024 00:06:20 GMT

If you use loadjob, it always loads an existing, previously run job.

If you run

| savedsearch ...

then it will run a new search. If that new search returns the wrong results, then it would seem likely that the search has not changed