splunk single value in embed

[rameshlpatel]

Hi

I have reports to show backlog count in numeric. I have used SPLUNK Single Value feature for that.

Query : index="OCSMONITOR" source="dbmon-tail://ocsrpt_ocsmonitor/QBacklogCount" | stats latest(BACKLOGCOUNT) as error | rangemap field=errors low=1-40 elevated=40-1500 default=severe

Time range : 5 min Window (Real Time)

But this are not giving me options of Schedule/ Embed report.

Please suggest me how could i create this as Embed report?

[somesoni2 · Accepted solution]

As per documentation, You can't embed a report until it is scheduled to run on a regular interval. And the scheduling is not applicable for realtime searches/reports. Hence, you're not getting any options to convert this to Embed scheduled report.

Instead, convert this to a regular search with 5 min window (earliest=-5m@m) and have it scheduled to run every 5min.

[rameshlpatel]

Thanks sir. It get resolved.