Cannot find artifacts for savedsearch_ident...

[dm1]

There is a dashboard which uses a scheduled search using the |loadjob command. 

I recently changed the search query for that scheduled search, which was basically added a index = indexname stanza to it to make it a little more efficient. 

However, after doing that, the dashboard started showing the below error

Cannot find artifacts for savedsearch_ident...

When I click on the "View Recent" option of the saved search, it still loads the results.

Any ideas? 

[isoutamo]

Maybe these helps you

• https://community.splunk.com/t5/Reporting/Why-am-I-getting-loadjob-error-quot-Cannot-find-artifacts-...
• https://community.splunk.com/t5/Reporting/Splunk-loadjob-failing-when-using-a-scheduled-report/m-p/4...
• https://community.splunk.com/t5/Dashboards-Visualizations/Why-is-my-dashboard-panel-returning-loadjo...
• On page: https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Loadjob
  • A search head cluster can run the loadjob command only on scheduled saved searches.

r. Ismo

[dm1 · Accepted solution]

I had a look through those posts but unfortunately, scenarios mentioned in those were not relevant to me.

To figure out the cause of this issue, I created a test scheduled search (SS) with almost same configuration (sourcetype=sample | stats count) as the one in question and ran it on a smaller schedule.

After the 1st run of SS,  loadjob command worked.

Before the 2nd SS run, I changed the search query to add the index= stanza. This time I again manually ran the loadjob command and it gave the same error as I got above. That confirmed in my case the error was more due to the fact that I changed the search query. After 2nd scheduled run (after query modification was made), loadjob command worked perfectly.