Reporting

Why is the saved search not pulling data even though Splunk has the data?

Communicator

Hi,

We have provided the savedsearch.conf file to our testing team which has many saved searches.
I am calling those saved searches through my java application which uses splunk SDK.

One of the saved search is not pulling the data even though splunk has data. I can see the data when I run the saved search in splunk UI, but the same is not working through java application.

To troubleshoot, I created another saved search with the same exact content (just copy and pasted in splunk UI and saved it). Somehow this saved search is fetching data through java application. I really have no idea why this is happening.

Can someone please help. It's very urgent.

Thanks in advance.

SplunkTrust
SplunkTrust

Hi,

Please check permission of that saved search which is not working, it looks like user in java application does not have access to that saved search or indexes which contain data.

0 Karma

Communicator

Sorry for the late response.

There was some timezone issue. We found and fixed it.

Thanks for your reply.

0 Karma