Reporting

Scheduled Search (Report) with attached CSV show 0 results, but executing the same search show correct results

LM_ACN
Engager

Hi everyone Splunker.

I'm actually dealing with a quite serious problem which let me send to our customer empty csv results.

A saved search for report has been scheduled to run once a day at 5 AM. The email has an empty csv file.

However, when i look for the report name within Splunk GUI and click on execute, it prompt me the correct results.

I thought was an authorizative problem related to the owner of the Report, but the owner is me, and i can see the right result both within the App in which the report exist, both everywhere.

The curious thing is that sometimes the csv attached to the email show the currect result, other time not (I've set the chron to run every ten minutes).

Please, may you help me?

Thanks in advance

Tags (1)
0 Karma

badrinath_itrs
Communicator

This might be related to authorization problem or some knowledge objects permission problem.
Can you run the schedule search with nobody or admin user to verify this issue. Please make sure the schedule search is created in correct app context and has access to all knowledge objects. When the schedule search is configured, please make sure it runs as owner context .

Refer below documentation for more details.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Report/Createandeditreports

0 Karma

to4kawa
Ultra Champion

spl please

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...