Dashboards & Visualizations

Using an accelerated report in a dashboard, why am I getting "Error in 'savedsearch' command: Unable to find saved search named..."?

IRHM73
Motivator

I wonder whether someone may be able to help me please.

I have a report called "Digital Match and Verify" which I've accelerated with a view to use this in a dashboard.

This is the section of the XML where I'm trying to link to the report.

<searchString> | savedsearch "Digital_Match_and_Verify" idaFullName=$username$ </searchString>
        <query>
        | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
        </query>

The problem I have is that when I try to run this, I receive the following error:

Error in 'savedsearch' command:
Unable to find saved search named
'Digital_Match_and_Verify'.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>

View solution in original post

0 Karma

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>
0 Karma

IRHM73
Motivator

Hi @woodcock, thank you very much for this it works great.

I just wasn't too sure how to handle the spaces in my report name.

Kind Regards

chris

0 Karma

woodcock
Esteemed Legend

You probably have a permissions problem. If they saved search had permissions scope of "App" and is in a different app than your dashboard, you will have this error. Try changing your saved search permissions to "all apps" and set the read bit for "everyone". Once you get it working, then go back and reduce the permissions as you see fit.

0 Karma

IRHM73
Motivator

Hi @woodcock, many thanks for this and I'll look into it.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...