All Apps and Add-ons

Why is Dashboard studios base search from report, "app undefined"?

KOJL
Explorer

Hi!

I have a set of python scripts running every night as part of an automation process. 
These scripts output data into the _internal index that is restricted for a large portion of the work force. 

However some teams should be able to view the output from these scripts as it would help them troubleshoot why hosts fail. 

I was hoping to solve the access issue by having a scheduled search run every night collecting the output of the python scripts and using that report as a base search in a new dashboard powered by dashboard studios. 

I would then just use the chain search function for creating the tables and reports that staff with less privileges could  use to access the otherwise unavailable information. 

But my problem is that I can not get the base search to work. 
Not matter what I put under the key 
App: "Put the name of the app holding the saved search here"

When I use the "open in search function" from the dashboard, I notice that whatever I put under the context of "app", splunk does not care, it always just resolves to "undefined".

Here is an example of the code from dashboard studios: 

{
"type": "ds.savedSearch",
"options": {
"ref": "internal_base_search", #this should be the name of the report
"app": "search" #The app where the report exist.
},
"name": "Saved Search Data Source From S&R"
}

So no matter what I do, the url I get using the "open in search" function, it points to: 

<hostname>:8000/en-US/app/undefined/search?s=Internal%20base%20search%20Clone

and if I manually change it to the app that holds the report it finds it just fine, for example: 

<hostname>:8000/en-US/app/search/search?s=Internal%20base%20search%20Clone

Has anyone had a simlar issue? 
This to me feels like a bug and that "APP" key in the json formatted source code does not resolve correctly.


Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...