Full error is
In handler 'scheduledviews': Could not find writer for: /<user.name>/<app.name>/savedsearches/_ScheduledView__<dashboard.name> [0] [D:\Program Files\Splunk\etc]
Test email and pdf generation works fine. Even though the error is returned the email addresses still show under More info > Schedule but after a refresh are gone.
What is going on here?
I found the source of my issue in splunkd.log. There was a case difference between the deployed app and the app folder under my username.
05-27-2014 12:07:15.208 -0500 WARN BundlesUtil - D:\Program Files\Splunk\etc\users\<user.name>\<APP.NAME>\history already exists but with different casing: D:\Program Files\Splunk\etc\users\<user.name>\<app.name>\history
Now however, after fixing the case issue and restarting Splunk I am seeing some more issues with PDF scheduling.
- When I create a Scheduled PDF delivery there are almost no values defined in savedsearches.conf the
action.email.to field is filled and the cron_schedule field but that's it. I am expecting to see a whole bunch of key/values here.
- When I create a new PDF delivery schedule it overwrites the existing one
- When I try to change permissions on the saved search I get
Splunk could not update permissions for resource scheduled/views [HTTP 409] [{'type': 'ERROR', 'text': 'Cannot overwrite existing app object', 'code': None}]- splunkd says
05-27-2014 13:33:09.736 -0500 ERROR SavedSearchAdminHandler - Cannot edit/create a saved search for wildcarded users or applications
So after removing all PDF schedules for that dashboard I was able to create a new one correctly and change its permissions, but subsequently created PDF delivery schedules still return the error above. Is this behavior expected?
