I have just same issue as below question!
https://answers.splunk.com/answers/498825/why-does-my-scheduled-report-deliver-results-in-pd.html
My environment
OS:Linux7
Splunk:Stand-Alone Splunk 7.1.2
In my environment, there is the report scheduled every 15 minutes.
And if I check status in job activity, it is "done", and job inspector says "completed" too.
But if I check the page of report itself, it says "There are no results because the first scheduled run of the report has not completed.".
Does anyone have same issue?
Also, does anyone know how to solve it?
Please someone give me some information about it.
Hi, I think you maybe have another issue, because I didn't have this problem in 6.x version or in 7.0, the bug I was struck by was only in version 7.1.1.
I believe this was the bug corrected in 7.1.2:
2018-06-03 SPL-154567, SPL-154139 embedded report uses oldest search artifact from the history endpoint
My case id was 001116998.
/Patrik
Hi,
It turned out to be a bug in 7.1.1, fixed in 7.1.2 (and newer).
,
Thank you for answer!
Would you tell me issue number of it?
Any reference for that? Unfortunately, I am running Splunk 6.5.1.
Hi, did you find any solution to this?
I am seeing the same thing on my installation. Have a scheduled report that says in the job monitor that it is "done", and when opening that job id link - it is run and shows the correct result.
But going in to the report and clicking the report it says "There are no results because the first scheduled...".
OS:Windows 2012 R2
Splunk stand-alone 7.1.1.
I have a very similar problem. I have number of users who can search on specific indices and theoretically can schedule reports, as their current role includes schedule_search capability. However, when a report is created and scheduled (even to run every minute) it always says:
"There are no results because the first scheduled run of the report has not completed."
Opening the report in search produces valid results though, and the search takes 1-2 seconds only.