How do I schedule a report with summary index enabled?

joachimroshan — Mon, 08 Jun 2020 22:50:02 GMT

I have created a scheduled search for the below query with the summary index enabled. When I open the link from the email generated, I get this response in Splunk:
"There are no results because the first scheduled run of the report has not completed."

I have scheduled the search to run for the last 30 days with a frequency of 1 hour.
Am I doing something incorrectly here? The Splunk version is 7.2.0

sourcetype="pcf:Log" AND cf_space_name=perf AND cf_org_name=* | timechart span=1h dc(span_id) by cf_org_name usenull=f useother=f limit=10

Re: How do I schedule a report with summary index enabled?

akocak — Wed, 30 Sep 2020 04:53:34 GMT

I think one solution could be , First, disable summary indexing from this scheduled search, and create a new scheduled search that runs after this search and works for summary indexing:

| savedsearch "timechart search scheduled" | sistats dc(span_id) by cf_org_name

topic How do I schedule a report with summary index enabled? in Reporting

How do I schedule a report with summary index enabled?

Re: How do I schedule a report with summary index enabled?