Dashboards & Visualizations

No scheduled job was found for saved search

rgustafson
Explorer

Hello,

I've created some new saved searches that run on schedules and when I load them into a dashboard I get an error stating "No scheduled job was found for saved search". I have the useHistory parameter turned on.

I've checked the following:

  • The searches have run several times on a schedule
  • Their exists entries in the dispatch directory with the same sid as the search ran
  • The permissions of the search are set to the app I'm viewing them from (everything is run under admin)
  • I've run a |loadjob and see search results

So why doesn't the dashboard load in the saved results?

<view template="dashboard.html" refresh="120">
  <label>Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    <param name="level">error</param> 
  </module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="System Status" autoRun="true">
   <param name="savedSearch">AA ALL Lost Host (D)</param>
     <param name="useHistory">True</param>
   <module name="PostProcess">
     <param name="search">stats count AS Count| rangemap field=Count default=red green=0-0</param>
     <module name="SingleValue">
       <param name="beforeLabel">Lost Hosts</param>
       <param name="classField">range</param>
       <param name="field">Count</param>
       <param name="linkSearch"></param>
       <param name="linkView">flashtimeline</param>
     </module>  
   </module>
 </module>

</view>

Drainy
Champion

Two things, are the dashboard and search within the same app context? and you're completely sure the permissions of the search are correct? I've just created a clone of the above and just used index=_internal as my saved search and it has run as expected. I could generate the "No scheduled Job was found" by loading the dashboard before the schedule or by changing the permission of the search so it can't be accessed.

0 Karma

rgustafson
Explorer

It is just a saved search

0 Karma

linu1988
Champion

"AA ALL Lost Host (D)",Is that a savedsearch or macro? if you are passing parameter the you have to mention the "Savedsearch var=value".

0 Karma

rgustafson
Explorer

Updated with XML.

I've tested the XML by replacing a good search with a cloned version of that search and I'm getting the same error.

0 Karma

asimagu
Builder

could you paste the XML?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...