I've been experiencing this for a while with saved searches and it looks like that once a saved search is done and you want to show the results in a dashboard, you cannot query another timerange over it.
For example, a saved search has Latest=@mon-2mon and Earliest=@d , and I'd like to use that saved search in a chart by using loadjob . I can't reduce the timerange to Latest=@mon-1mon and Earliest=@mon-1d for example. I'd get the following error:
Error in 'SearchOperator:loadjob': Cannot find artifacts within the search time range for savedsearch_ident '::'.
This happens for any timerange I want to use as filter on the results of the savedsearch original timerange... This is weird, because, why wouldn't I be able to do a time-based filter on the savedsearch's result set to limit the data I want to see, while I can do filter on fields? Doesn't make sense to me. Am I doing something wrong here?
<--- EDIT --->
For simplicity, here a simple savedsearch:
index=testindex host=testhost earliest=@mon-1 latest=@now
After the savedsearch is done, and I'm trying to Edit search of the view within the dashboard as following:
| loadjob savedsearch="username:app:savedsearchname
Change timerange to something different than All times - ofcourse, within the start and end time of the original query
Then I get the error message above.
</--- EDIT --->
... View more