I have created a scheduled search for the below query with the summary index enabled. When I open the link from the email generated, I get this response in Splunk:
"There are no results because the first scheduled run of the report has not completed."
I have scheduled the search to run for the last 30 days with a frequency of 1 hour.
Am I doing something incorrectly here? The Splunk version is 7.2.0
sourcetype="pcf:Log" AND cf_space_name=perf AND cf_org_name=* | timechart span=1h dc(span_id) by cf_org_name usenull=f useother=f limit=10
I think one solution could be , First, disable summary indexing from this scheduled search, and create a new scheduled search that runs after this search and works for summary indexing:
| savedsearch "timechart search scheduled" | sistats dc(span_id) by cf_org_name