Dashboards & Visualizations

No scheduled job was found for saved search

rgustafson
Explorer

Hello,

I've created some new saved searches that run on schedules and when I load them into a dashboard I get an error stating "No scheduled job was found for saved search". I have the useHistory parameter turned on.

I've checked the following:

  • The searches have run several times on a schedule
  • Their exists entries in the dispatch directory with the same sid as the search ran
  • The permissions of the search are set to the app I'm viewing them from (everything is run under admin)
  • I've run a |loadjob and see search results

So why doesn't the dashboard load in the saved results?

<view template="dashboard.html" refresh="120">
  <label>Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    <param name="level">error</param> 
  </module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="System Status" autoRun="true">
   <param name="savedSearch">AA ALL Lost Host (D)</param>
     <param name="useHistory">True</param>
   <module name="PostProcess">
     <param name="search">stats count AS Count| rangemap field=Count default=red green=0-0</param>
     <module name="SingleValue">
       <param name="beforeLabel">Lost Hosts</param>
       <param name="classField">range</param>
       <param name="field">Count</param>
       <param name="linkSearch"></param>
       <param name="linkView">flashtimeline</param>
     </module>  
   </module>
 </module>

</view>

Drainy
Champion

Two things, are the dashboard and search within the same app context? and you're completely sure the permissions of the search are correct? I've just created a clone of the above and just used index=_internal as my saved search and it has run as expected. I could generate the "No scheduled Job was found" by loading the dashboard before the schedule or by changing the permission of the search so it can't be accessed.

0 Karma

rgustafson
Explorer

It is just a saved search

0 Karma

linu1988
Champion

"AA ALL Lost Host (D)",Is that a savedsearch or macro? if you are passing parameter the you have to mention the "Savedsearch var=value".

0 Karma

rgustafson
Explorer

Updated with XML.

I've tested the XML by replacing a good search with a cloned version of that search and I'm getting the same error.

0 Karma

asimagu
Builder

could you paste the XML?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...