Splunk ITSI

Getting Error while using Saved Search in Correlation search

bmssathish
New Member

Hi,

I am trying to use Saved search as ad-hoc querry while creating correlation search. But getting below error while saving it. could anyone pls help ?

"Invalid search string: Error in 'savedsearch' command: Unable to find saved search named 'XXX-XXX-XXXX'.."

Thanks

0 Karma

szhou_splunk
Splunk Employee
Splunk Employee

Hi, would you check if the saved search 'XXX-XXX-XXXX' exists and enabled, and accessible by ITSI? You can test the correlation search string by click "Run Search" before saving the correlation search.

0 Karma

bmssathish
New Member

Hi, Yes saved search is available and i am able to "Run Search" before saving it but getting error only while saving it.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...