Saved searches have a different behavior than ad hoc searches in that they only return requested fields. You need to explicitly state what fields you want returned with the fields command. Alternatively, you can use the command to return all fields: <your search string> | fields *   ... View more

We had the same problem deploying the same app (Splunk_SA_Scientific_Python_Linux_x86_64) using the deployer. Under the hood, the deployer is using HTTP to push app bundles to the Search Head Cluster. The search heads (acting as an HTTP server) are rejecting the bundle for this app because it exceeds the default setting for content length. You need to modify server.conf on the search heads to include the following setting: [httpServer] max_content_length = 5000000000 This changes the default setting from 2147483648 (about 2 GB) to 5 GB. ... View more