I also read this from a response to a USRP user's question about RSSI measurements:

[The] Received Signal Strength [Indicator is] always relative to some signal model, incorporating considered bandwidth, assumptions on the modulation scheme, duration of transmission, generally: It's a estimation of received signal strength based on some property of the received signal.

Yes, I wrote that, and I still think it applies, so:

What is the difference between RSSI measurements and the dBm values that I record from the spectrum analyzer?

Well, the RSSI is calculated based on some signal-model based estimator, whereas the dBm value on your spectrum analyzer is calculated with another metric – namely, the power measured going through a filter with the filter bandwidth you configured at your spectrum analyzer.

These two might, or might not be related, taking into account that even a signal with very low power spectral density values might be sufficiently good for something that has e.g. matched filters to extract the signal from noise, or any other form of processing gain.

So, your only option is to understand both estimators, with the Spectrum Analyzer estimator being relatively simple, and the flex estimator being free and open source (so you can just read the code ), and relate the two; so basically, you'll have to find, given a (class of) signal(s) $s(t)$, the functions $f_{SA}$, $f_{flex}$ and finally $g$ from

$$\begin{align} P_\text{spectrum analyzer}\left(s(t)\right) &= f_{SA}\left(s(t)\right)\\ P_\text{flex frame sync RSSI}\left(s(t)\right) &= f_{flex}\left(s(t)\right)\\ \leadsto P_\text{flex}'\left(P_\text{spectrum analyzer}\right) &= g(f_{SA}\left(s(t)\right))\text{ .} \end{align}$$

I've just skimmed the liquiddsp code for the RSSI estimation, and the interesting part seems to happen in qdetector_cccf_execute_align.

However, this can never work without making a lot of assumptions. For example, if your signal happens to have a very narrow, but very strong single tone interferer, it will probably not break flex reception, and if that RSSI estimator is any good, not change RSSI very much, but it will drastically change the dBm value displayed by your spectrum analyzer. So if the question was

Can I find an estimator that always gives me the same reading as the liquidDSP flex RSSI based on the dBm value displayed by a spectrum analyzer?

then the answer is a

No. See above prove by counterexample (single tone interferer).

However:

If I cannot relate these two measurements by a correction factor, is there a way to obtain the receive signal power measurements (in dBm) programmatically (GNUradio perhaps)?

Sure. Why not? You got the raw samples, don't you? So do a magnitude squared of them, and find a linear correction factor. That will work (have done so multiple times), because now you're actually measuring to things that relate to each other (signal amplitude as seen by your SDR frontend's ADC and signal power as seen by the spectrum analyzer simply have a quadratic relation).

Note that you will have to re-calibrate for different frequencies, sampling rates, if settable, analog frontend widths (only applies to B2xx, E3xx, and a few very old daughterboards for your N2xx currently; by the way, the TVRX* boards have always-on AGC, so they can't be used for this).

The relationship between input voltage and digital number amplitude is linear for quite a large range for the Ettus frontends – however, as soon as your input amplifier and mixers start reaching saturation, this will no longer apply, so you did good to use a few dB of attenuation.

If you happen to have a WBX, SBX, CBX or UBX daughterboard, there's IP2/IP3 measurements (along with effective vs set gain) available that will help you estimate the region of linearity on http://files.ettus.com/performance_data/.