Not able to access saved searches (report) through Splunk ODBC?

[manojkumargowda]

Hello All,

We are not able to access some saved searches through ODBC splunk connector while we can access some saved searches. I guess it is to do with the permissions of the saved searches (report) in Splunk. We tried giving all the accesses to the report, but still it doesn't return any result in QLiksense (reporting tool) using Splunk ODBC.

[niyaz006]

Can we pull data directly from the index using odbc? Or only saved searches?

[richgalloway]

ODBC does not support ad-hoc queries.  They must invoke a saved search.

[manojkumargowda]

Also one more thing is, when we run the saved search through ODBC, it creates a job in Splunk. The jobs for the saved searches which are not fetching any records are getting expired in few seconds while the ones that are accessible by Splunk ODBC are usually expires after few minutes. 

Is this something to do with the above issue? 

[richgalloway]

That error message do not mean you cannot access the saved search.  It means the saved search ran successfully, but produced no results.  Depending on the search, that my be completely normal.

[manojkumargowda]

Thanks @richgalloway  for your response.

Yes, you are right. Saved search ran successfully but it didn't fetch any records. The same saved search returns results when I run it in Splunk UI. 

It's weird that I can access some saved searches through Splunk ODBC, but some are not, though both are having same permissions.  

[richgalloway]

Make sure the ODBC user has the role(s) necessary to access the desired saved searches and the indexes that feed them.