Reporting

Scheduled Search (Report) with attached CSV show 0 results, but executing the same search show correct results

LM_ACN
Engager

Hi everyone Splunker.

I'm actually dealing with a quite serious problem which let me send to our customer empty csv results.

A saved search for report has been scheduled to run once a day at 5 AM. The email has an empty csv file.

However, when i look for the report name within Splunk GUI and click on execute, it prompt me the correct results.

I thought was an authorizative problem related to the owner of the Report, but the owner is me, and i can see the right result both within the App in which the report exist, both everywhere.

The curious thing is that sometimes the csv attached to the email show the currect result, other time not (I've set the chron to run every ten minutes).

Please, may you help me?

Thanks in advance

Tags (1)
0 Karma

badrinath_itrs
Communicator

This might be related to authorization problem or some knowledge objects permission problem.
Can you run the schedule search with nobody or admin user to verify this issue. Please make sure the schedule search is created in correct app context and has access to all knowledge objects. When the schedule search is configured, please make sure it runs as owner context .

Refer below documentation for more details.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Report/Createandeditreports

0 Karma

to4kawa
Ultra Champion

spl please

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...