There are no results because the first scheduled run of the report has not completed.

[lmonahan]

Hi,

(I see previous questions on this topic but haven't been able to find the answer to my issue).

I have a report that has been running successfully for some time but the owner was recently removed from Splunk.

When I visit the report URL now I get the message "There are no results because the first scheduled run of the report has not completed."

The report appears to run successfully however as this query says it was successful for status:

index=_internal sourcetype=scheduler | stats count by savedsearch_name status user

I notice that the URL to the report now has "nobody" in it and wonder if this relates to the issue. I feel like perhaps the report is running successfully but the URL to access it is incorrect?

To get the URL I use these steps:

1. Navigate to the app in Splunk
2. Click on Reports
3. Click on the name of the report in the Title column
4. The result is: There are no results because the first scheduled run of the report has not completed.

I saw documentation for reassigning owners to orphaned knowledge objects. We did change the owner for one of the reports but the result is the same.

Thank you!

[DalJeanis]

Find out when the last time it actually ran is

    index=_internal sourcetype=scheduler | stats count max(_time) as _time by savedsearch_name status user

[lmonahan]

Thank you for that query. I see that it ran today but still when I click on the name I get the same "There are no results because the first scheduled run of the report has not completed."

Here is the timestamp of the last time it ran, just after midnight today:

2020-04-14 00:01:22.259