topic Re: Splunk loadjob not returning data but savedsearch does in Splunk Search

Splunk loadjob not returning data but savedsearch does

gagandeep_arora — Tue, 14 May 2019 11:23:27 GMT

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report

Re: Splunk loadjob not returning data but savedsearch does

eugenek — Wed, 05 Jun 2019 19:59:54 GMT

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

Re: Splunk loadjob not returning data but savedsearch does

hallt3 — Wed, 05 Jun 2019 20:41:42 GMT

Another guess could be a permissions thing between the users / apps

Re: Splunk loadjob not returning data but savedsearch does

eugenek — Wed, 05 Jun 2019 20:50:22 GMT

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

Re: Splunk loadjob not returning data but savedsearch does

codebuilder — Thu, 06 Jun 2019 03:15:34 GMT

I second what eugenek suggested, it's spot on.

Re: Splunk loadjob not returning data but savedsearch does

dm1 — Mon, 01 Nov 2021 23:58:30 GMT

did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks!