Hi!
I have a set of python scripts running every night as part of an automation process.
These scripts output data into the _internal index that is restricted for a large portion of the work force.
However some teams should be able to view the output from these scripts as it would help them troubleshoot why hosts fail.
I was hoping to solve the access issue by having a scheduled search run every night collecting the output of the python scripts and using that report as a base search in a new dashboard powered by dashboard studios.
I would then just use the chain search function for creating the tables and reports that staff with less privileges could use to access the otherwise unavailable information.
But my problem is that I can not get the base search to work.
Not matter what I put under the key
App: "Put the name of the app holding the saved search here"
When I use the "open in search function" from the dashboard, I notice that whatever I put under the context of "app", splunk does not care, it always just resolves to "undefined".
Here is an example of the code from dashboard studios:
{
"type": "ds.savedSearch",
"options": {
"ref": "internal_base_search", #this should be the name of the report
"app": "search" #The app where the report exist.
},
"name": "Saved Search Data Source From S&R"
}
So no matter what I do, the url I get using the "open in search" function, it points to:
<hostname>:8000/en-US/app/undefined/search?s=Internal%20base%20search%20Clone
and if I manually change it to the app that holds the report it finds it just fine, for example:
<hostname>:8000/en-US/app/search/search?s=Internal%20base%20search%20Clone
Has anyone had a simlar issue?
This to me feels like a bug and that "APP" key in the json formatted source code does not resolve correctly.
