Dashboards & Visualizations

Using an accelerated report in a dashboard, why am I getting "Error in 'savedsearch' command: Unable to find saved search named..."?

IRHM73
Motivator

I wonder whether someone may be able to help me please.

I have a report called "Digital Match and Verify" which I've accelerated with a view to use this in a dashboard.

This is the section of the XML where I'm trying to link to the report.

<searchString> | savedsearch "Digital_Match_and_Verify" idaFullName=$username$ </searchString>
        <query>
        | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
        </query>

The problem I have is that when I try to run this, I receive the following error:

Error in 'savedsearch' command:
Unable to find saved search named
'Digital_Match_and_Verify'.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>

View solution in original post

0 Karma

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>
0 Karma

IRHM73
Motivator

Hi @woodcock, thank you very much for this it works great.

I just wasn't too sure how to handle the spaces in my report name.

Kind Regards

chris

0 Karma

woodcock
Esteemed Legend

You probably have a permissions problem. If they saved search had permissions scope of "App" and is in a different app than your dashboard, you will have this error. Try changing your saved search permissions to "all apps" and set the read bit for "everyone". Once you get it working, then go back and reduce the permissions as you see fit.

0 Karma

IRHM73
Motivator

Hi @woodcock, many thanks for this and I'll look into it.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...

Thank You for Celebrating CX Day with Splunk!

Yesterday the entire team at Splunk &#43; Cisco joined the global celebration of CX Day - celebrating our ...