I have multiple reports that email daily summary results. Recently they have started to come through randomly with "No results found", when you click on the link to "view the results in splunk" and it shows the same, but when you search with the same criteria it shows the expected results. Any ideas?
I'm on Splunk 6.2.3
Check time range of your report and tour schedule. Make sure that time range of your report is less than time range of schedule.
This means that you most be sure that your report produce results before time range of schedule may be achive.
So if your machine take a lot of time to produce result in your report, you must take that time in consideration when you'll define time range of your schedule report.
The reports are for either today or last 24 hours results, the search results appear in a few seconds when searching manually
Yes, all the results are shown inline in the email. To be clear most days it works but some days it doesn't. but its becoming more frequent.
Hi do you figure out the cause and have a fix of this issue ? we start to seeing this on some of the scheduled reports. Any helps would be appreciated !
hongklee - please open a new question describing your current issue. Asking your question on the end of an old post will not get you good useful answers as fast as opening a new question with a good description of what you are having trouble with. (Please feel free to link to this answer in your question, but try to describe the issue clearly yourself, in case there are any details that might matter that were different for you from this prior post.)