Reporting

BUG: scheduled search fails to load if the search begins with a "pipe" command (6.0.5)

Champion

The scheduled search is scheduled properly and runs with no errors per _internal log. However the search artifacts are never retrievable. Through a few months of working with support and several troubleshooting binaries, we have discovered that this is caused by some bug with Splunk failing to properly run scheduled search queries that begin with a pipe.

E.g.:
| inputlookup
| tstats

Currently awaiting response and a fix from Splunk. Not sure if other versions are affected.

0 Karma
1 Solution

Champion

Fixed in version 6.2.7 and 6.3.*

View solution in original post

Champion

Fixed in version 6.2.7 and 6.3.*

View solution in original post