I have a report which is scheduled and embedded.
my search query is index=_internal log_level="%log_level%" | stats count by log_level
log_level is my token here.
I have scheduled this query and embedded it by which I got Iframe URL.
Now how can I use this URL to pass token into my saved report as it doesn't have a field=value pair in URL?
This is not a feature Splunk supports. Scheduled reports do not support Tokens, and embedded reports can only be created from a scheduled report.
There is no support for any data to affect the outcome of the search. You might be best to grant access to splunk and use an iframe of a dashboard providing that access but removing the headers and footers.
Add this to the dashboard XML Or in the URL provided simple add hideChrome in the url arguments.
Are you stating you have a iframe of a scheduled searches results on a Splunk dashboard or is this iframe in another non-Splunk page using an embedded url link to the saved report populating the data in the iframe? If it's a dashboard, can you copy/paste the xml from your dashboard into the question?
If this comment/answer was helpful, please up vote it. Thank you.