Why are embedded reports from a search head cluster sometimes blank?

[Olivier44]

Hello,

I made a web page with 4 embedded reports from Splunk. The reports are scheduled every 5 minutes and the web page reload itself every 1 minute. The embedded reports are pointing to one search head which is in a search head cluster.

My problem is that sometimes, some reports are blank, but the others are good!

Anyone has an idea of where is the problem ?

Thanks

[renjith_nair · Accepted solution]

The scheduled report runs randomly on one of the search heads on the cluster. So it might not be on the search head where you have set the embedding. On top of that there was a bug in splunk which affects the behavior but this is fixed in 6.3

Also remember to set the embedSecret = in server.conf .

Details are

When using report embedding, normally the generated URLs can only
  be used on the search head they were generated on
* If "embedSecret" is set, then the token in the URL will be encrypted
  with this key.  Then other search heads with the exact same setting
  can also use the same URL.
* This is needed if you want to use report embedding across multiple
  nodes on a search head pool.

I'm running a search head cluster with url loadbalancing and embedded report works fine there.