Dashboards & Visualizations

No scheduled job was found for saved search

rgustafson
Explorer

Hello,

I've created some new saved searches that run on schedules and when I load them into a dashboard I get an error stating "No scheduled job was found for saved search". I have the useHistory parameter turned on.

I've checked the following:

  • The searches have run several times on a schedule
  • Their exists entries in the dispatch directory with the same sid as the search ran
  • The permissions of the search are set to the app I'm viewing them from (everything is run under admin)
  • I've run a |loadjob and see search results

So why doesn't the dashboard load in the saved results?

<view template="dashboard.html" refresh="120">
  <label>Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    <param name="level">error</param> 
  </module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="System Status" autoRun="true">
   <param name="savedSearch">AA ALL Lost Host (D)</param>
     <param name="useHistory">True</param>
   <module name="PostProcess">
     <param name="search">stats count AS Count| rangemap field=Count default=red green=0-0</param>
     <module name="SingleValue">
       <param name="beforeLabel">Lost Hosts</param>
       <param name="classField">range</param>
       <param name="field">Count</param>
       <param name="linkSearch"></param>
       <param name="linkView">flashtimeline</param>
     </module>  
   </module>
 </module>

</view>

Drainy
Champion

Two things, are the dashboard and search within the same app context? and you're completely sure the permissions of the search are correct? I've just created a clone of the above and just used index=_internal as my saved search and it has run as expected. I could generate the "No scheduled Job was found" by loading the dashboard before the schedule or by changing the permission of the search so it can't be accessed.

0 Karma

rgustafson
Explorer

It is just a saved search

0 Karma

linu1988
Champion

"AA ALL Lost Host (D)",Is that a savedsearch or macro? if you are passing parameter the you have to mention the "Savedsearch var=value".

0 Karma

rgustafson
Explorer

Updated with XML.

I've tested the XML by replacing a good search with a cloned version of that search and I'm getting the same error.

0 Karma

asimagu
Builder

could you paste the XML?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...