First time running into this issue. I made a new report of suspicious logons (24 hours) to run once a day. The search itself returns good results, and the resulting PDF from the scheduled report email also shows expected results.
The issue is that when i go to view the report from Splunk Web (reports > click on the report), it still says "There are no results because the first scheduled run of the report has not completed." with a button to open in search, which is still working and shows the search results as expected.
I've tried deleting the report, and recreating it, but it is perpetually saying it hasn't run yet when it clearly has since last Thursday!
appreciate any insight into this issue.
thanks!
↧