i created a saved report. avgTrafficVolume as admin (saved it as global permission)
Confirmed it is in the reports list
Confirmed it is in the savedSearches.conf
./etc/apps/search/local/savedsearches.conf:[avgTrafficVolume]
Run the loadjob command in splunk web
|loadjob savedsearch="admin.search.avgTrafficVolume"
Expected: the saved report is run
Actual: Error in 'SearchOperator:loadjob': The savedsearch argument format is invalid. Expecting 'user:application:savedsearch-name'.
Did I do anything wrong? What do I need to do to get the loadJob to work?
Just guessing that loadJob only works with scheduled report; the scheduled report must be run at least once. I have reconfigured the saved report as scheduled. Will check the results tomorrow.
20171101> updated. confirmed it is working.
| loadJob savedsearch="admin:search:avgTrafficVolume"
Sharing the result to all that loadjob works only for scheduled reports. Hope others will find this useful
"Load Job" is not working in production web version 6.4.0.
Kindly suggest.
,i have tried the same but it is still not working.
Kindly help.
Just guessing that loadJob only works with scheduled report; the scheduled report must be run at least once. I have reconfigured the saved report as scheduled. Will check the results tomorrow.
20171101> updated. confirmed it is working.
| loadJob savedsearch="admin:search:avgTrafficVolume"
Sharing the result to all that loadjob works only for scheduled reports. Hope others will find this useful
i tried this but still failed
| loadjob savedsearch="admin:search:avgTrafficVolume"
Actual: Error in 'SearchOperator:loadjob': Cannot find artifacts for savedsearch_ident 'admin:search:avgTrafficVolume'.
Tried all these combinations
| loadjob savedsearch="avgTrafficVolume"
| loadjob savedsearch="search:avgTrafficVolume"
| loadjob savedsearch="nobody:search:avgTrafficVolume"
| loadjob savedsearch="admin:search:avgTrafficVolume"