Splunk Enterprise

Why is this scheduled search not return results?

jip31
Motivator

Hi

In my dashboard, I use a search with 2 different ways

1) a inline search which works fine

2) a scheduled search which is exactly the same that the inline search but which returns any results even if the search ended correctly !

NB : this search was returning results at the beginning so it's very strange

I dont know if it's important but when I have a look at the job inspector I have the message below :

 

 

info : [subsearch]: Your timerange was substituted based on your search string

 

 

and what is even stranger is that when I run the search apart (it means outside the dashboard) I have also no results!

how is it possible please?

thanks

 

Labels (1)
Tags (1)
0 Karma
1 Solution

jip31
Motivator

I have found

it was due to the dispatch.earliest_time and dispatch.latest_time parameters

View solution in original post

0 Karma

jip31
Motivator

😀I am sure the issue dont comes directly from the search...

It was working a few days ago

how the same search works inline the dashboard and dont works outside the dashboard even if I dont use the scheduled search?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK, that's a little bit more information but still not enough for us to provide any meaningful assistance.

0 Karma

jip31
Motivator

I have found

it was due to the dispatch.earliest_time and dispatch.latest_time parameters

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

My guess is that line 3 of your search is wrong - anyone else for the sweepstake?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...