Dashboards & Visualizations

Using an accelerated report in a dashboard, why am I getting "Error in 'savedsearch' command: Unable to find saved search named..."?

IRHM73
Motivator

I wonder whether someone may be able to help me please.

I have a report called "Digital Match and Verify" which I've accelerated with a view to use this in a dashboard.

This is the section of the XML where I'm trying to link to the report.

<searchString> | savedsearch "Digital_Match_and_Verify" idaFullName=$username$ </searchString>
        <query>
        | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
        </query>

The problem I have is that when I try to run this, I receive the following error:

Error in 'savedsearch' command:
Unable to find saved search named
'Digital_Match_and_Verify'.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>

View solution in original post

0 Karma

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>
0 Karma

IRHM73
Motivator

Hi @woodcock, thank you very much for this it works great.

I just wasn't too sure how to handle the spaces in my report name.

Kind Regards

chris

0 Karma

woodcock
Esteemed Legend

You probably have a permissions problem. If they saved search had permissions scope of "App" and is in a different app than your dashboard, you will have this error. Try changing your saved search permissions to "all apps" and set the read bit for "everyone". Once you get it working, then go back and reduce the permissions as you see fit.

0 Karma

IRHM73
Motivator

Hi @woodcock, many thanks for this and I'll look into it.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...