Dashboards & Visualizations

No scheduled job was found for saved search

rgustafson
Explorer

Hello,

I've created some new saved searches that run on schedules and when I load them into a dashboard I get an error stating "No scheduled job was found for saved search". I have the useHistory parameter turned on.

I've checked the following:

  • The searches have run several times on a schedule
  • Their exists entries in the dispatch directory with the same sid as the search ran
  • The permissions of the search are set to the app I'm viewing them from (everything is run under admin)
  • I've run a |loadjob and see search results

So why doesn't the dashboard load in the saved results?

<view template="dashboard.html" refresh="120">
  <label>Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    <param name="level">error</param> 
  </module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="System Status" autoRun="true">
   <param name="savedSearch">AA ALL Lost Host (D)</param>
     <param name="useHistory">True</param>
   <module name="PostProcess">
     <param name="search">stats count AS Count| rangemap field=Count default=red green=0-0</param>
     <module name="SingleValue">
       <param name="beforeLabel">Lost Hosts</param>
       <param name="classField">range</param>
       <param name="field">Count</param>
       <param name="linkSearch"></param>
       <param name="linkView">flashtimeline</param>
     </module>  
   </module>
 </module>

</view>

Drainy
Champion

Two things, are the dashboard and search within the same app context? and you're completely sure the permissions of the search are correct? I've just created a clone of the above and just used index=_internal as my saved search and it has run as expected. I could generate the "No scheduled Job was found" by loading the dashboard before the schedule or by changing the permission of the search so it can't be accessed.

0 Karma

rgustafson
Explorer

It is just a saved search

0 Karma

linu1988
Champion

"AA ALL Lost Host (D)",Is that a savedsearch or macro? if you are passing parameter the you have to mention the "Savedsearch var=value".

0 Karma

rgustafson
Explorer

Updated with XML.

I've tested the XML by replacing a good search with a cloned version of that search and I'm getting the same error.

0 Karma

asimagu
Builder

could you paste the XML?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...