09-23-2014 19:17:05.101 +0000 ERROR SearchOperator:savedsplunk - Error in 'savedsearch' command: Unable to find saved search named 'ADSCV_SSP_REQUESTS'.
Running the command
| savedsearch ADSCV_SSP_REQUESTS
Gives me a UI error
Error in 'savedsearch' command: Unable to find saved search named 'ADSCV_SSP_REQUESTS'.
The saved search is scheduled under the same user trying to run the saved search command. The saved search has read access to all roles. The saved search is shared at the app level in the search app. What is causing this error?
i am facing error when running : hostname:port/services/search/jobs/export end point through postman
Input : search%3D%7C%20savedsearch%20MySavedSearch
<messages> <msg type="FATAL">Empty search.</msg> </messages>
Same saved search is running in web successfully.
Turns out that the search was disabled due to type. Had a default stanza in between a saved search, causing all of the underlying searches that was owned by the user to be disabled.
I have ran the saved search command using an admin role user and was successful. I created a new account with the same role as the user that owns this search and has it scheduled. It also ran successful. Running it as the owner seems to be causing the error.
Please let me know how I can get this resolved.