Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to reference a scheduled report for a base sea...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am trying to create a base search for my post process searches that references a scheduled report. From looking around I found that you use the following
<search id="baseSearch" ref="Scheduled_Report>
<query></query>
</search>
However, when I edit the XML it gives the following validation warning "Unknown attribute "ref" for node "search"". Was this feature deprecated in newer versions of Splunk or is it an error on my end? Are there any other ways to reference a scheduled report?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, that was a typo on my part. I managed to get it working though, for some reason once I removed the
<query></query> line the warning disappears and it appears to work fine. Thanks for the help though!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, that was a typo on my part. I managed to get it working though, for some reason once I removed the
<query></query> line the warning disappears and it appears to work fine. Thanks for the help though!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad thing worked out for you. Please accept this as solution for other reader's reference.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What version of Splunk are you using? Is the 'Scheduled_Report' available in the same app as your dashboard?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk 6.5. Yes, the report is available in the same app
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well it does work in 6.5.0. Upon seeing your xml code in the question, you're missing a double quote, is that a typo here?
Accelerating Observability as Code with the Splunk AI Assistant
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
