Reporting

How to run saved search command?

srowe
Explorer

Hi All,

I have been using Splunk for about 2 years now and just learned about the savedsearch command. I would LOVE to implement this as I have the need to append together a lot of search terms that are already defined in existing saved searches.

From what I've read, all I should need to do is type "| savedsearch "My Saved Search"" right? Unfortunately, that throws an error in splunk that reads:

"Error in 'SearchParser':Missing a search command before ''."

When I try without the leading pipe, I get it to run but it brings back 0 results.

Does anyone know what I'm doing wrong here? I would love to be able to use this feature. Does the saved search need to be scheduled? I also tried that with no luck, but maybe my scheduled search settings are off.

Thanks in advance, Sarah

Tags (1)
1 Solution

somesoni2
Revered Legend

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

View solution in original post

somesoni2
Revered Legend

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

srowe
Explorer

Wow - that worked! Thanks somesoni2! I would never have figured that out on my own.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...