- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk loadjob not returning data but savedsearch does
gagandeep_arora
Path Finder
05-14-2019
04:23 AM
Hello all,
I am seeing a weird issue.
I am logged in as admin and my search is saved as scheduled search.
This is not giving any result:
| loadjob savedsearch="admin:search:my_test_report"
This is giving result:
| savedsearch my_test_report
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dm1
Contributor
11-01-2021
04:58 PM
did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
eugenek
Path Finder
06-05-2019
12:59 PM
Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hallt3
Path Finder
06-05-2019
01:41 PM
Another guess could be a permissions thing between the users / apps
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
codebuilder
Influencer
06-05-2019
08:15 PM
I second what eugenek suggested, it's spot on.
----
An upvote would be appreciated and Accept Solution if it helps!
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
eugenek
Path Finder
06-05-2019
01:50 PM
I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.
