Reporting

loadjob': The savedsearch argument format is invalid. Expecting 'user:application:savedsearch-name'

Path Finder

i created a saved report. avgTrafficVolume as admin (saved it as global permission)

Confirmed it is in the reports list
Confirmed it is in the savedSearches.conf

find . -name 'search.conf' -exec grep avgTrafficVolume {} /dev/null \;

./etc/apps/search/local/savedsearches.conf:[avgTrafficVolume]

Run the loadjob command in splunk web
|loadjob savedsearch="admin.search.avgTrafficVolume"

Expected: the saved report is run
Actual: Error in 'SearchOperator:loadjob': The savedsearch argument format is invalid. Expecting 'user:application:savedsearch-name'.

Did I do anything wrong? What do I need to do to get the loadJob to work?

0 Karma
1 Solution

Path Finder

Just guessing that loadJob only works with scheduled report; the scheduled report must be run at least once. I have reconfigured the saved report as scheduled. Will check the results tomorrow.

20171101> updated. confirmed it is working.
| loadJob savedsearch="admin:search:avgTrafficVolume"

Sharing the result to all that loadjob works only for scheduled reports. Hope others will find this useful

View solution in original post

0 Karma

New Member

"Load Job" is not working in production web version 6.4.0.

Kindly suggest.
,i have tried the same but it is still not working.

Kindly help.

0 Karma

Path Finder

Just guessing that loadJob only works with scheduled report; the scheduled report must be run at least once. I have reconfigured the saved report as scheduled. Will check the results tomorrow.

20171101> updated. confirmed it is working.
| loadJob savedsearch="admin:search:avgTrafficVolume"

Sharing the result to all that loadjob works only for scheduled reports. Hope others will find this useful

View solution in original post

0 Karma

Path Finder

i tried this but still failed
| loadjob savedsearch="admin:search:avgTrafficVolume"

Actual: Error in 'SearchOperator:loadjob': Cannot find artifacts for savedsearch_ident 'admin:search:avgTrafficVolume'.

Tried all these combinations
| loadjob savedsearch="avgTrafficVolume"
| loadjob savedsearch="search:avgTrafficVolume"
| loadjob savedsearch="nobody:search:avgTrafficVolume"
| loadjob savedsearch="admin:search:avgTrafficVolume"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!