Full error is
In handler 'scheduledviews': Could not find writer for: /<user.name>/<app.name>/savedsearches/_ScheduledView__<dashboard.name> [0] [D:\Program Files\Splunk\etc]
Test email and pdf generation works fine. Even though the error is returned the email addresses still show under More info > Schedule but after a refresh are gone.
What is going on here?
I found the source of my issue in splunkd.log. There was a case difference between the deployed app and the app folder under my username.
05-27-2014 12:07:15.208 -0500 WARN BundlesUtil - D:\Program Files\Splunk\etc\users\<user.name>\<APP.NAME>\history already exists but with different casing: D:\Program Files\Splunk\etc\users\<user.name>\<app.name>\history
Now however, after fixing the case issue and restarting Splunk I am seeing some more issues with PDF scheduling.
action.email.to
field is filled and the cron_schedule
field but that's it. I am expecting to see a whole bunch of key/values here. Splunk could not update permissions for resource scheduled/views [HTTP 409] [{'type': 'ERROR', 'text': 'Cannot overwrite existing app object', 'code': None}]
05-27-2014 13:33:09.736 -0500 ERROR SavedSearchAdminHandler - Cannot edit/create a saved search for wildcarded users or applications
So after removing all PDF schedules for that dashboard I was able to create a new one correctly and change its permissions, but subsequently created PDF delivery schedules still return the error above. Is this behavior expected?
http://answers.splunk.com/answers/56747/could-not-find-writer
I found that if you look at either _internal index or the local splunkd.log, there's probably going to be more detail. In my case, it was a file permissions issue writing to $SPLUNK_HOME/etc/users/
http://answers.splunk.com/answers/56747/could-not-find-writer
I found that if you look at either _internal index or the local splunkd.log, there's probably going to be more detail. In my case, it was a file permissions issue writing to $SPLUNK_HOME/etc/users/
Ah, yes I found my answer in splunkd.log. There was a case difference between the deployed app and the app folder under my username.
Now however, after fixing the case issue and restarting Splunk I am seeing even more issues with PDF scheduling. I will update the body.