With some experimenting, I've found that saved searches that are visible to all apps, and readable by everyone, do not have results that are accessible to other apps. That means that although you can add them to a dashboard or view in another app, the search will be run in real time when you load the view. Are saved scheduled search reports only available in their respective apps regardless of the search permission settings?
I came across this issue and tried using the move feature in the Saved Search manager (when logged in as admin). Server error.[1]
So I cloned the search and assigned the clone to the app I wanted. That method sort of worked. The search was copied, but not the report -- my chart was all wanky with default settings. I could see no way in the GUI to edit the saved search's chart settings, so I copied the viewstate stanza from the old search into the viewstate.conf file local to the target app, put that viewstate into savedsearches.conf, and restarted Splunk. Shouldn't 'clone' clone everything? Is there a better way to get properly configured charts copied in the cloning process?
[1] error message:
500 Internal Server Error
RESTException: [HTTP 409] [{'text': "In handler 'savedsearch': Object with
id=REPORT_Web_Errors_by_Host already exists in config=savedsearches, user=nobody,
app=my_app", 'code': None, 'type': 'ERROR'}]; None
... View more