Hi,
I created a saved search without specifying owner. Form S.o.S, such saved search is showing owner as "No owner". This is expected because I did not specify owner.
But when I use 'loadjob' to get the result from such saved search, it askes to pass "< user-string>:< application-string>:< search-name-string>" triplet as parameter. I have tried to pass "No owner', "Any", "-", "", as the "< user-string>" in the triplet. None of them works for me.
What should I specify as user-string in this case?
Thanks in advanced and here is the Splunk document about this:
Syntax: savedsearch="< user-string>:< application-string>:< search-name-string>"
Description: The unique identifier of a savedsearch whose artifacts need to be loaded. A savedsearch is uniquely identified by the triplet {user, application, savedsearch name}, for example: search="admin:search:my saved search"
