Dashboards & Visualizations

Using an accelerated report in a dashboard, why am I getting "Error in 'savedsearch' command: Unable to find saved search named..."?

IRHM73
Motivator

I wonder whether someone may be able to help me please.

I have a report called "Digital Match and Verify" which I've accelerated with a view to use this in a dashboard.

This is the section of the XML where I'm trying to link to the report.

<searchString> | savedsearch "Digital_Match_and_Verify" idaFullName=$username$ </searchString>
        <query>
        | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
        </query>

The problem I have is that when I try to run this, I receive the following error:

Error in 'savedsearch' command:
Unable to find saved search named
'Digital_Match_and_Verify'.

I just wondered whether someone may be able to look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

0 Karma
1 Solution

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>

View solution in original post

0 Karma

woodcock
Esteemed Legend

You say you have a search called Digital Match and Verify (spaces for word separators) but you are referencing it as Digital_Match_and_Verify (underscores for word separators). That will be 2 different searches. Try this:

 <searchString> | savedsearch "Digital Match and Verify" idaFullName=$username$ </searchString>
     <query>
     | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt
     </query>
0 Karma

IRHM73
Motivator

Hi @woodcock, thank you very much for this it works great.

I just wasn't too sure how to handle the spaces in my report name.

Kind Regards

chris

0 Karma

woodcock
Esteemed Legend

You probably have a permissions problem. If they saved search had permissions scope of "App" and is in a different app than your dashboard, you will have this error. Try changing your saved search permissions to "all apps" and set the read bit for "everyone". Once you get it working, then go back and reduce the permissions as you see fit.

0 Karma

IRHM73
Motivator

Hi @woodcock, many thanks for this and I'll look into it.

Kind Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...