Splunk Search

Splunk loadjob not returning data but savedsearch does

gagandeep_arora
Path Finder

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report
0 Karma

dm1
Communicator

did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks!

0 Karma

eugenek
Path Finder

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

0 Karma

hallt3
Path Finder

Another guess could be a permissions thing between the users / apps

0 Karma

codebuilder
SplunkTrust
SplunkTrust

I second what eugenek suggested, it's spot on.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

eugenek
Path Finder

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!