Splunk Search

Splunk loadjob not returning data but savedsearch does

Path Finder

Hello all,
I am seeing a weird issue.

I am logged in as admin and my search is saved as scheduled search.

This is not giving any result:

| loadjob savedsearch="admin:search:my_test_report"

This is giving result:

| savedsearch my_test_report
0 Karma

Path Finder

Without additional info, my suggestion would be to check the time range on your |loadjob command and check that the admin:search:my_test_report hasn't expired.

0 Karma

Path Finder

Another guess could be a permissions thing between the users / apps

0 Karma

Motivator

I second what eugenek suggested, it's spot on.

0 Karma

Path Finder

I am logged in as admin
makes me think it's not a permissions issue. Could be in the wrong app though.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!