(I see previous questions on this topic but haven't been able to find the answer to my issue).
I have a report that has been running successfully for some time but the owner was recently removed from Splunk.
When I visit the report URL now I get the message "There are no results because the first scheduled run of the report has not completed."
The report appears to run successfully however as this query says it was successful for status:
index=_internal sourcetype=scheduler | stats count by savedsearch_name status user
I notice that the URL to the report now has "nobody" in it and wonder if this relates to the issue. I feel like perhaps the report is running successfully but the URL to access it is incorrect?
To get the URL I use these steps:
I saw documentation for reassigning owners to orphaned knowledge objects. We did change the owner for one of the reports but the result is the same.
Find out when the last time it actually ran is
index=_internal sourcetype=scheduler | stats count max(_time) as _time by savedsearch_name status user
Thank you for that query. I see that it ran today but still when I click on the name I get the same "There are no results because the first scheduled run of the report has not completed."
Here is the timestamp of the last time it ran, just after midnight today: