Splunk Search

Splunk loadjob not returning data but savedsearch does

gagandeep_arora
Path Finder

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report
0 Karma

dm1
Contributor

did you end up finding the cause of this issue and resolution ? if yes, please share. Thanks!

0 Karma

eugenek
Path Finder

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

0 Karma

hallt3
Path Finder

Another guess could be a permissions thing between the users / apps

0 Karma

codebuilder
Influencer

I second what eugenek suggested, it's spot on.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

eugenek
Path Finder

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...