Why is the saved search not pulling data even though Splunk has the data?

[angelinealex]

Hi,

We have provided the savedsearch.conf file to our testing team which has many saved searches.
I am calling those saved searches through my java application which uses splunk SDK.

One of the saved search is not pulling the data even though splunk has data. I can see the data when I run the saved search in splunk UI, but the same is not working through java application.

To troubleshoot, I created another saved search with the same exact content (just copy and pasted in splunk UI and saved it). Somehow this saved search is fetching data through java application. I really have no idea why this is happening.

Can someone please help. It's very urgent.

Thanks in advance.

[harsmarvania57]

Hi,

Please check permission of that saved search which is not working, it looks like user in java application does not have access to that saved search or indexes which contain data.

[angelinealex]

Sorry for the late response.

There was some timezone issue. We found and fixed it.

Thanks for your reply.