I have created a scheduled search for the below query with the summary index enabled. When I open the link from the email generated, I get this response in Splunk: "There are no results because the first scheduled run of the report has not completed."
I have scheduled the search to run for the last 30 days with a frequency of 1 hour. Am I doing something incorrectly here? The Splunk version is 7.2.0
sourcetype="pcf:Log" AND cf_space_name=perf AND cf_org_name=* | timechart span=1h dc(span_id) by cf_org_name usenull=f useother=f limit=10