Reporting

How to run saved search command?

srowe
Explorer

Hi All,

I have been using Splunk for about 2 years now and just learned about the savedsearch command. I would LOVE to implement this as I have the need to append together a lot of search terms that are already defined in existing saved searches.

From what I've read, all I should need to do is type "| savedsearch "My Saved Search"" right? Unfortunately, that throws an error in splunk that reads:

"Error in 'SearchParser':Missing a search command before ''."

When I try without the leading pipe, I get it to run but it brings back 0 results.

Does anyone know what I'm doing wrong here? I would love to be able to use this feature. Does the saved search need to be scheduled? I also tried that with no luck, but maybe my scheduled search settings are off.

Thanks in advance, Sarah

Tags (1)
1 Solution

somesoni2
Revered Legend

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

View solution in original post

somesoni2
Revered Legend

Validate that the search string of saved search doesn't have extra line feed. I would remove line feeds and extra spaces from the saved search first.

View solution in original post

srowe
Explorer

Wow - that worked! Thanks somesoni2! I would never have figured that out on my own.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!