Have you eliminated app permissions/shares at the user level?  The saved search may run as user or as a default account(noone). The btool has a switch for "-- user" which I'm not 100% familiar with but the docs do warn about having to use the switch "--app" as well, but then says the switch user does not consider knowledge object permissions when evaluating the user. ... View more

I'm curious about this value. "reason": "unrecognized character follows \\", Since the \\ is a literal escape is it reading the remainder of the message as text until the next naturally occurring " on it's own?  Can you try changing the "\\" in the text portion of the message to "escape character set".   ... View more

Once the base search runs with the filtered status the results are all that is left over.  You need to isolate your inputs source from your results query.  In this case 2 or more base searches are needed. Things I have done/learned while doing this. - tstats search commands are much faster especially pulling single fields, use this if you can - inputs have limits on displaying unique values, enable search and wildcard options for long lists, never over 1,000 unique values if I recall correctly ... View more