<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Failed to get list of scheduled times for saved search in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577450#M201235</link>
    <description>&lt;P&gt;Thank you for the reply, I tried that but I still get the same result.&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Mon, 06 Dec 2021 11:12:44 GMT</pubDate>
    <dc:creator>MidnightRun</dc:creator>
    <dc:date>2021-12-06T11:12:44Z</dc:date>
    <item>
      <title>Failed to get list of scheduled times for saved search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577375#M201211</link>
      <description>&lt;P&gt;I'm trying to backfill my summary index with 2 months worth of data with a report that gives results from the last minute. This is my report:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp; &amp;nbsp;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="python"&gt;action.email.useNSSubject = 1
action.summary_index = 1
action.summary_index._type = event
alert.track = 0
cron_schedule = */1 * * * *
dispatch.earliest_time = -1m
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype","Price","ID","Date","Time"]
display.general.type = statistics
display.page.search.tab = statistics
display.visualizations.show = 0
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_app = myapp
request.ui_dispatch_view = search
schedule_priority = higher
search = index="myindex" sourcetype="mysource"
| append [ search index="myindex" sourcetype="mysource" earliest=-1mon@mon latest=@mon
| stats avg(Price) as past_avg by ID ]
| eventstats values(past_avg) as past_avg by ID
| where Price &amp;gt; past_avg
| stats values(*) as * by ID
| table ID, Price, past_avg&lt;/LI-CODE&gt;&lt;P&gt;I tried to fill it using this command:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;splunk cmd python fill_summary_index.py -app Myapp -name "Summary_Population" -et -2mon@mon -lt @mon -dedup true&lt;/LI-CODE&gt;&lt;P&gt;but I get this error:&lt;/P&gt;&lt;LI-CODE lang="python"&gt;*** For saved search 'Summary_Populating' ***
Failed to get list of scheduled times for saved search 'Summary_Populating' (app = 'Myapp', error = '[HTTP 404] https://127.0.0.1:8089/servicesNS/Myusername/Myapp/saved/searches/Summary_Populating/scheduled_times?earliest_time=-mon%40mon&amp;amp;latest_time=%40now; [{'type': 'ERROR', 'code': None, 'text': 'Action forbidden.'}]'

No searches to run&lt;/LI-CODE&gt;&lt;P&gt;Does anyone have any idea why is this occurring and how to fix it?&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 06 Dec 2021 00:37:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577375#M201211</guid>
      <dc:creator>MidnightRun</dc:creator>
      <dc:date>2021-12-06T00:37:10Z</dc:date>
    </item>
    <item>
      <title>Re: Failed to get list of scheduled times for saved search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577382#M201214</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/241230"&gt;@MidnightRun&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Try with the&amp;nbsp;&lt;/SPAN&gt;&lt;STRONG&gt;-owner&lt;/STRONG&gt;&lt;SPAN&gt;&amp;nbsp;option for searches that are owned by a specific user or role. And also provide &lt;STRONG&gt;-auth username:password&lt;/STRONG&gt; option.&lt;BR /&gt;&lt;/SPAN&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;splunk cmd python fill_summary_index.py -app Myapp -name "Summary_Population" -et -2mon@mon -lt @mon -dedup true -owner admin -auth admin:password&lt;/LI-CODE&gt;&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 06 Dec 2021 04:03:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577382#M201214</guid>
      <dc:creator>manjunathmeti</dc:creator>
      <dc:date>2021-12-06T04:03:25Z</dc:date>
    </item>
    <item>
      <title>Re: Failed to get list of scheduled times for saved search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577450#M201235</link>
      <description>&lt;P&gt;Thank you for the reply, I tried that but I still get the same result.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 06 Dec 2021 11:12:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577450#M201235</guid>
      <dc:creator>MidnightRun</dc:creator>
      <dc:date>2021-12-06T11:12:44Z</dc:date>
    </item>
    <item>
      <title>Re: Failed to get list of scheduled times for saved search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577463#M201240</link>
      <description>&lt;P&gt;Stupid mistake, I misspelled the name of the app and didn't notice it until now.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 06 Dec 2021 12:14:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Failed-to-get-list-of-scheduled-times-for-saved-search/m-p/577463#M201240</guid>
      <dc:creator>MidnightRun</dc:creator>
      <dc:date>2021-12-06T12:14:25Z</dc:date>
    </item>
  </channel>
</rss>

