Dashboards & Visualizations

Using an accelerated report in a dashboard, why am I getting "Error in 'savedsearch' command: Unable to find saved search named..."?

IRHM73
Motivator

I wonder whether someone may be able to help me please.

I have a report called "Digital Match and Verify" which I've accelerated with a view to use this in a dashboard.

This is the section of the XML where I'm trying to link to the report.

<searchString> | savedsearch "Digital_Match_and_Verify" idaFullName=$username$ </searchString>
        <query>
        | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
        </query>

The problem I have is that when I try to run this, I receive the following error:

Error in 'savedsearch' command:
Unable to find saved search named
'Digital_Match_and_Verify'.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>

View solution in original post

0 Karma

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>
0 Karma

IRHM73
Motivator

Hi @woodcock, thank you very much for this it works great.

I just wasn't too sure how to handle the spaces in my report name.

Kind Regards

chris

0 Karma

woodcock
Esteemed Legend

You probably have a permissions problem. If they saved search had permissions scope of "App" and is in a different app than your dashboard, you will have this error. Try changing your saved search permissions to "all apps" and set the read bit for "everyone". Once you get it working, then go back and reduce the permissions as you see fit.

0 Karma

IRHM73
Motivator

Hi @woodcock, many thanks for this and I'll look into it.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...