I have a dashboard in which there are multiple panels and it has 3 base searches defined in it. I'm getting the below errors while scheduling PDF delivery for the dashboard but while manually exporting the PDF I'm not getting any errors.I'm getting the below errors for only 2 panels of the Dashboard:-
Server reported HTTP status=400 while getting mode=results<?xml version="1.0" encoding="UTF-8"?><response> <messages> <msg type="FATAL">Error in 'SearchOperator:loadjob': Cannot find artifacts for savedsearch_ident '$subsearch_sid3$'.</msg> </messages></response>
Both the Panel Searches are using loadjob commands.Loadjob command is using the SID of previous searches to get the results.
@swastikm123 Since, loadjob and post-process searches use Dispatch directly artifacts on SH to pull search results directly, for your Scheduled Dashboard PDF delivery it might be possible that Dispatch directory is getting cleaned up when search result are getting pulled up in the dashboard. Since this is scheduled dashboard can you use regular search query instead of loadjob?
If the issue persists reach out to Splunk Support with relevant details to get assistance.
@swastikm123 best would be to open a support ticket and work with the Support team by providing them with required details. Seems like your SPL is very expensive or pulls a lot of data. Have you checked dispatch directory size and usage, search logs, failure details?