How to run saved search command?

srowe — Wed, 11 Jun 2014 15:58:08 GMT

Hi All,

I have been using Splunk for about 2 years now and just learned about the savedsearch command. I would LOVE to implement this as I have the need to append together a lot of search terms that are already defined in existing saved searches.

From what I've read, all I should need to do is type "| savedsearch "My Saved Search"" right? Unfortunately, that throws an error in splunk that reads:

"Error in 'SearchParser':Missing a search command before ''."

When I try without the leading pipe, I get it to run but it brings back 0 results.

Does anyone know what I'm doing wrong here? I would love to be able to use this feature. Does the saved search need to be scheduled? I also tried that with no luck, but maybe my scheduled search settings are off.

Thanks in advance, Sarah

Re: How to run saved search command?

somesoni2 — Wed, 11 Jun 2014 16:46:29 GMT

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

Re: How to run saved search command?

srowe — Wed, 11 Jun 2014 17:03:49 GMT

Wow - that worked! Thanks somesoni2! I would never have figured that out on my own.

topic Re: How to run saved search command? in Reporting

How to run saved search command?

Re: How to run saved search command?

Re: How to run saved search command?