I have a report which is scheduled and embedded.
my search query is index=internal loglevel="%loglevel%" | stats count by loglevel
log_level is my token here.
I have scheduled this query and embedded it by which I got Iframe URL.
Now how can I use this URL to pass token into my saved report as it doesn't have a field=value pair in URL?
Are you stating you have a iframe of a scheduled searches results on a Splunk dashboard or is this iframe in another non-Splunk page using an embedded url link to the saved report populating the data in the iframe? If it's a dashboard, can you copy/paste the xml from your dashboard into the question?
This is not a feature Splunk supports. Scheduled reports do not support Tokens, and embedded reports can only be created from a scheduled report.
There is no support for any data to affect the outcome of the search. You might be best to grant access to splunk and use an iframe of a dashboard providing that access but removing the headers and footers.
Add this to the dashboard XML Or in the URL provided simple add hideChrome in the url arguments.