Hi,
I am trying to create a base search for my post process searches that references a scheduled report. From looking around I found that you use the following
<search id="baseSearch" ref="Scheduled_Report>
<query></query>
</search>
However, when I edit the XML it gives the following validation warning "Unknown attribute "ref" for node "search"". Was this feature deprecated in newer versions of Splunk or is it an error on my end? Are there any other ways to reference a scheduled report?
Yeah, that was a typo on my part. I managed to get it working though, for some reason once I removed the
<query></query>
line the warning disappears and it appears to work fine. Thanks for the help though!
Yeah, that was a typo on my part. I managed to get it working though, for some reason once I removed the
<query></query>
line the warning disappears and it appears to work fine. Thanks for the help though!
Glad thing worked out for you. Please accept this as solution for other reader's reference.
What version of Splunk are you using? Is the 'Scheduled_Report' available in the same app as your dashboard?
Splunk 6.5. Yes, the report is available in the same app
Well it does work in 6.5.0. Upon seeing your xml code in the question, you're missing a double quote, is that a typo here?