Splunk Search

Splunk loadjob not returning data but savedsearch does

gagandeep_arora
Path Finder

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report
0 Karma

dm1
Contributor

did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks!

0 Karma

eugenek
Path Finder

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

0 Karma

hallt3
Path Finder

Another guess could be a permissions thing between the users / apps

0 Karma

codebuilder
Influencer

I second what eugenek suggested, it's spot on.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

eugenek
Path Finder

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...