Dashboards & Visualizations

No scheduled job was found for saved search

rgustafson
Explorer

Hello,

I've created some new saved searches that run on schedules and when I load them into a dashboard I get an error stating "No scheduled job was found for saved search". I have the useHistory parameter turned on.

I've checked the following:

  • The searches have run several times on a schedule
  • Their exists entries in the dispatch directory with the same sid as the search ran
  • The permissions of the search are set to the app I'm viewing them from (everything is run under admin)
  • I've run a |loadjob and see search results

So why doesn't the dashboard load in the saved results?

<view template="dashboard.html" refresh="120">
  <label>Dashboard</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
    <param name="level">error</param> 
  </module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="System Status" autoRun="true">
   <param name="savedSearch">AA ALL Lost Host (D)</param>
     <param name="useHistory">True</param>
   <module name="PostProcess">
     <param name="search">stats count AS Count| rangemap field=Count default=red green=0-0</param>
     <module name="SingleValue">
       <param name="beforeLabel">Lost Hosts</param>
       <param name="classField">range</param>
       <param name="field">Count</param>
       <param name="linkSearch"></param>
       <param name="linkView">flashtimeline</param>
     </module>  
   </module>
 </module>

</view>

Drainy
Champion

Two things, are the dashboard and search within the same app context? and you're completely sure the permissions of the search are correct? I've just created a clone of the above and just used index=_internal as my saved search and it has run as expected. I could generate the "No scheduled Job was found" by loading the dashboard before the schedule or by changing the permission of the search so it can't be accessed.

0 Karma

rgustafson
Explorer

It is just a saved search

0 Karma

linu1988
Champion

"AA ALL Lost Host (D)",Is that a savedsearch or macro? if you are passing parameter the you have to mention the "Savedsearch var=value".

0 Karma

rgustafson
Explorer

Updated with XML.

I've tested the XML by replacing a good search with a cloned version of that search and I'm getting the same error.

0 Karma

asimagu
Builder

could you paste the XML?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...