Why am I getting "Encountered an error while reading file..." using loadjob for a savedsearch?

[vrmandadi]

| loadjob savedsearch="admin:app_utc_rgswin:app_utc_rgswin_TotalHostsByWeek" | timechart span=1d latest("# of Hosts") AS "# of Hosts" | search "# of Hosts" = *

When trying to run the search above, I'm getting this error:

Encountered an error while reading file 'F:\Splunk\var\run\splunk\dispatch\scheduler__admin_YXBwX3V0Y19yZ3N3aW4__RMD52ef372a2bc27f2fc_at_1440771000_1731\results.csv.gz'. 

Can anyone please help in this issue?

[muebel]

Looks like a filesystem permissions issue. Make sure that that file exists, and that the user splunk is running as can read the file.

[bmas10]

This happens when the search the saved search is trying to load is empty or did not run because of errors.

[nnmiller]

Check to see if

F:\Splunk\var\run\splunk\dispatch\scheduler__admin_YXBwX3V0Y19yZ3N3aW4__RMD52ef372a2bc27f2fc_at_1440771000_1731\results.csv.gz

exists and the permissions on the file.

[cramasta]

Didnt you already ask this question on another thread?

What happens when you try and run this...
| savedsearch app_utc_rgswin_TotalHostsByWeek

[vrmandadi]

this is a different error

[cramasta]

Did you run the query i sent?

[vrmandadi]

yup it says cannot find artifacts for saved search

[cramasta]

Thats not making sense. The savedsearch command should just try and run the query behind the saved search, not load artifacts. Are you the person who created the search? Do you have permissions to access the saved search?

[vrmandadi]

I have not created the query and I do have the permission to access it.

[somesoni2]

I believe that could be the reason for your loadjob failure. I haven't tested it, but I don't think so any non-admin user should be able to see result of other people's search result.

[cramasta]

Yeah if you don't have read permissions on a saved search then you will not be able to view the cached jobs