Reporting

Why am I getting "Encountered an error while reading file..." using loadjob for a savedsearch?

vrmandadi
Builder
| loadjob savedsearch="admin:app_utc_rgswin:app_utc_rgswin_TotalHostsByWeek" | timechart span=1d latest("# of Hosts") AS "# of Hosts" | search "# of Hosts" = *

When trying to run the search above, I'm getting this error:

Encountered an error while reading file 'F:\Splunk\var\run\splunk\dispatch\scheduler__admin_YXBwX3V0Y19yZ3N3aW4__RMD52ef372a2bc27f2fc_at_1440771000_1731\results.csv.gz'. 

Can anyone please help in this issue?

Tags (2)

muebel
SplunkTrust
SplunkTrust

Looks like a filesystem permissions issue. Make sure that that file exists, and that the user splunk is running as can read the file.

0 Karma

bmas10
Explorer

This happens when the search the saved search is trying to load is empty or did not run because of errors.

0 Karma

nnmiller
Contributor

Check to see if

F:\Splunk\var\run\splunk\dispatch\scheduler__admin_YXBwX3V0Y19yZ3N3aW4__RMD52ef372a2bc27f2fc_at_1440771000_1731\results.csv.gz

exists and the permissions on the file.

0 Karma

cramasta
Builder

Didnt you already ask this question on another thread?

What happens when you try and run this...
| savedsearch app_utc_rgswin_TotalHostsByWeek

0 Karma

vrmandadi
Builder

this is a different error

0 Karma

cramasta
Builder

Did you run the query i sent?

0 Karma

vrmandadi
Builder

yup it says cannot find artifacts for saved search

0 Karma

cramasta
Builder

Thats not making sense. The savedsearch command should just try and run the query behind the saved search, not load artifacts. Are you the person who created the search? Do you have permissions to access the saved search?

0 Karma

vrmandadi
Builder

I have not created the query and I do have the permission to access it.

0 Karma

somesoni2
Revered Legend

I believe that could be the reason for your loadjob failure. I haven't tested it, but I don't think so any non-admin user should be able to see result of other people's search result.

0 Karma

cramasta
Builder

Yeah if you don't have read permissions on a saved search then you will not be able to view the cached jobs

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...