The scheduled report runs randomly on one of the search heads on the cluster. So it might not be on the search head where you have set the embedding. On top of that there was a bug in splunk which affects the behavior but this is fixed in 6.3 Also remember to set the embedSecret = in server.conf . Details are When using report embedding, normally the generated URLs can only be used on the search head they were generated on * If "embedSecret" is set, then the token in the URL will be encrypted with this key. Then other search heads with the exact same setting can also use the same URL. * This is needed if you want to use report embedding across multiple nodes on a search head pool. I'm running a search head cluster with url loadbalancing and embedded report works fine there. ... View more