How to run saved search command?

[srowe]

Hi All,

I have been using Splunk for about 2 years now and just learned about the savedsearch command. I would LOVE to implement this as I have the need to append together a lot of search terms that are already defined in existing saved searches.

From what I've read, all I should need to do is type "| savedsearch "My Saved Search"" right? Unfortunately, that throws an error in splunk that reads:

"Error in 'SearchParser':Missing a search command before ''."

When I try without the leading pipe, I get it to run but it brings back 0 results.

Does anyone know what I'm doing wrong here? I would love to be able to use this feature. Does the saved search need to be scheduled? I also tried that with no luck, but maybe my scheduled search settings are off.

Thanks in advance, Sarah

[somesoni2 · Accepted solution]

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

[srowe]

Wow - that worked! Thanks somesoni2! I would never have figured that out on my own.