Splunk Search

Failed to get list of scheduled times for saved search

MidnightRun
Explorer

I'm trying to backfill my summary index with 2 months worth of data with a report that gives results from the last minute. This is my report:

 

    

action.email.useNSSubject = 1
action.summary_index = 1
action.summary_index._type = event
alert.track = 0
cron_schedule = */1 * * * *
dispatch.earliest_time = -1m
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype","Price","ID","Date","Time"]
display.general.type = statistics
display.page.search.tab = statistics
display.visualizations.show = 0
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_app = myapp
request.ui_dispatch_view = search
schedule_priority = higher
search = index="myindex" sourcetype="mysource"
| append [ search index="myindex" sourcetype="mysource" earliest=-1mon@mon latest=@mon
| stats avg(Price) as past_avg by ID ]
| eventstats values(past_avg) as past_avg by ID
| where Price > past_avg
| stats values(*) as * by ID
| table ID, Price, past_avg

I tried to fill it using this command:

splunk cmd python fill_summary_index.py -app Myapp -name "Summary_Population" -et -2mon@mon -lt @mon -dedup true

but I get this error:

*** For saved search 'Summary_Populating' ***
Failed to get list of scheduled times for saved search 'Summary_Populating' (app = 'Myapp', error = '[HTTP 404] https://127.0.0.1:8089/servicesNS/Myusername/Myapp/saved/searches/Summary_Populating/scheduled_times?earliest_time=-mon%40mon&latest_time=%40now; [{'type': 'ERROR', 'code': None, 'text': 'Action forbidden.'}]'

No searches to run

Does anyone have any idea why is this occurring and how to fix it? 

0 Karma
1 Solution

MidnightRun
Explorer

Stupid mistake, I misspelled the name of the app and didn't notice it until now. 

View solution in original post

0 Karma

MidnightRun
Explorer

Stupid mistake, I misspelled the name of the app and didn't notice it until now. 

0 Karma

manjunathmeti
Champion

Hi @MidnightRun,

Try with the -owner option for searches that are owned by a specific user or role. And also provide -auth username:password option.

splunk cmd python fill_summary_index.py -app Myapp -name "Summary_Population" -et -2mon@mon -lt @mon -dedup true -owner admin -auth admin:password

 

0 Karma

MidnightRun
Explorer

Thank you for the reply, I tried that but I still get the same result. 

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...