All Apps and Add-ons

Why is Dashboard studios base search from report, "app undefined"?



I have a set of python scripts running every night as part of an automation process. 
These scripts output data into the _internal index that is restricted for a large portion of the work force. 

However some teams should be able to view the output from these scripts as it would help them troubleshoot why hosts fail. 

I was hoping to solve the access issue by having a scheduled search run every night collecting the output of the python scripts and using that report as a base search in a new dashboard powered by dashboard studios. 

I would then just use the chain search function for creating the tables and reports that staff with less privileges could  use to access the otherwise unavailable information. 

But my problem is that I can not get the base search to work. 
Not matter what I put under the key 
App: "Put the name of the app holding the saved search here"

When I use the "open in search function" from the dashboard, I notice that whatever I put under the context of "app", splunk does not care, it always just resolves to "undefined".

Here is an example of the code from dashboard studios: 

"type": "ds.savedSearch",
"options": {
"ref": "internal_base_search", #this should be the name of the report
"app": "search" #The app where the report exist.
"name": "Saved Search Data Source From S&R"

So no matter what I do, the url I get using the "open in search" function, it points to: 


and if I manually change it to the app that holds the report it finds it just fine, for example: 


Has anyone had a simlar issue? 
This to me feels like a bug and that "APP" key in the json formatted source code does not resolve correctly.

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...