topic Re: How to find variable in argument map for a saved search? in Splunk Search

How to find variable in argument map for a saved search?

neerajs_81 — Tue, 29 Nov 2022 13:56:05 GMT

Hello,
When trying to execute a savedsearch from the UI , it throws an error :Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'Incident Review - Main': Error while replacing variable name='type_filter'. Could not find variable in the argument map..

There is no variable by this name - type_filter in the query.
We are on the latest version of Splunk cloud 8.2.x. This search was working fine till yesterday and nothing has changed from our end. The Splunk cloud team did perform a maintenance for updates last night.

How to resolve this ? Any assistance appreciate.

Re: Saved Search: Could not find variable in Argument Map

lakscust01 — Wed, 09 Nov 2022 14:08:26 GMT

Issue still seen in ES 7.0.1 on Splunk Core 9.0.1

Re: Saved Search: Could not find variable in Argument Map

hieuba6868 — Tue, 29 Nov 2022 10:10:11 GMT

Did you get any solution for this issue ?

Re: Saved Search: Could not find variable in Argument Map

neerajs_81 — Tue, 29 Nov 2022 15:00:42 GMT

No not yet

Re: How to find variable in argument map for a saved search?

paulstark2 — Fri, 23 Aug 2024 15:53:09 GMT

similar error here, resolved

i had a correlation rule is ES calling saved search, it required the addition of "type_filter"

Re: How to find variable in argument map for a saved search?

paulstark2 — Fri, 23 Aug 2024 20:22:14 GMT

| savedsearch "Incident Review - Main" time_filter="" event_id_filter="" source_filter="" security_domain_filter="" status_filter="status=\"1\"" owner_filter="" urgency_filter="urgency=\"critical\" OR urgency=\"high\" OR urgency=\"medium\" OR urgency=\"low\" OR urgency=\"unknown\"" tag_filter=""