topic Re: Why is saved search not found for dashboard panel? in Dashboards & Visualizations

Why is saved search not found for dashboard panel?

xvxt006 — Wed, 13 Aug 2014 13:39:04 GMT

Hi,

In a dashboard i have added a panel and used Report instead of an inline search to populate data. But it keeps complaining that it could not find the saved search. When i actually verify manually it is there. do you know what could be the reason for this?

Re: Why is saved search not found for dashboard panel?

aelliott — Wed, 13 Aug 2014 13:42:45 GMT

Have you checked the permissions of that saved search.

Re: Why is saved search not found for dashboard panel?

xvxt006 — Wed, 13 Aug 2014 14:47:11 GMT

yes it is public

Re: Why is saved search not found for dashboard panel?

aelliott — Wed, 13 Aug 2014 14:56:08 GMT

http://docs.splunk.com/Documentation/ODBC/1.0.1/UseODBC/Savedsearchnotfoundmessage .. could this be possibly related to your issue?

Re: Why is saved search not found for dashboard panel?

ElijahLynn — Fri, 12 Feb 2016 04:18:16 GMT

In my case it was the use of / in the report name as in Origin hits/day (-7days). This is a bug in Splunk. If you don't have a / look for another character that could be throwing it off for just panel usage.

Re: Why is saved search not found for dashboard panel?

Sarmbrister — Thu, 10 Nov 2016 19:09:42 GMT

Have you checked the xml? I am currently having this same issue and saw that the xml is missing. I have no idea how it got deleted but without that I don't think the search will be able to run. Hope this helps.
your search query

Re: Why is saved search not found for dashboard panel?

aferone — Fri, 02 Dec 2016 17:12:53 GMT

This is my exact issue. Good catch. Thank you!

Re: Why is saved search not found for dashboard panel?

usd0872 — Wed, 20 Sep 2017 19:19:31 GMT

Thanks for finding this out.
Ran into the same problem and probably would not have figured it out myself.

Interesting variation I had on this: it worked fine when accessing splunk with a short hostname (eg: splunk:8000) and I only got the error when using a fully qualified domain name (eg: splunk.my.domain.org:8000).