Dashboards & Visualizations

How to reference a scheduled report for a base search

Path Finder

Hi,

I am trying to create a base search for my post process searches that references a scheduled report. From looking around I found that you use the following

<search id="baseSearch" ref="Scheduled_Report>
    <query></query>
  </search>

However, when I edit the XML it gives the following validation warning "Unknown attribute "ref" for node "search"". Was this feature deprecated in newer versions of Splunk or is it an error on my end? Are there any other ways to reference a scheduled report?

1 Solution

Path Finder

Yeah, that was a typo on my part. I managed to get it working though, for some reason once I removed the
<query></query> line the warning disappears and it appears to work fine. Thanks for the help though!

View solution in original post

Path Finder

Yeah, that was a typo on my part. I managed to get it working though, for some reason once I removed the
<query></query> line the warning disappears and it appears to work fine. Thanks for the help though!

View solution in original post

Revered Legend

Glad thing worked out for you. Please accept this as solution for other reader's reference.

0 Karma

Revered Legend

What version of Splunk are you using? Is the 'Scheduled_Report' available in the same app as your dashboard?

0 Karma

Path Finder

Splunk 6.5. Yes, the report is available in the same app

0 Karma

Revered Legend

Well it does work in 6.5.0. Upon seeing your xml code in the question, you're missing a double quote, is that a typo here?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!