Splunk Search
Highlighted

Splunk loadjob not returning data but savedsearch does

Path Finder

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report
0 Karma
Highlighted

Re: Splunk loadjob not returning data but savedsearch does

Path Finder

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

0 Karma
Highlighted

Re: Splunk loadjob not returning data but savedsearch does

Path Finder

Another guess could be a permissions thing between the users / apps

0 Karma
Highlighted

Re: Splunk loadjob not returning data but savedsearch does

Path Finder

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

0 Karma
Highlighted

Re: Splunk loadjob not returning data but savedsearch does

Motivator

I second what eugenek suggested, it's spot on.

0 Karma