New Splunk reporting
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
New Splunk reporting
Report builder
This new feature includes a completely redesigned graphical interface for analyzing raw events, creating tables of statistics, and creating charts. Users are guided through the process of selecting data to report on from search results, transforming this data with commonly used statistical operators, and formatting and visualizing the data in either a table or chart. Capabilities include:
- Quickly select fields directly from search results to generate charts and tables during investigations
- Perform advanced statistical operations on events such as grouping, frequency calculations, sum, average, maximum, minimum, standard deviation and correlation without the need to know advanced search commands
- Preview results and charts while a report is running
- Choose from several predefined report types to quickly visualize top values, trends over time, plot distributions, and correlate data
- Improved flash-based charting engine offers faster rendering of bar, column, area, line, pie and scatter chart types
- Configure axis labels, title, legend placement, scale (linear and logarithmic), and x and y axis range and increment settings directly from the user interface
- Add or remove a data series directly from the user interface
- Visualize tables in 'heatmap' view, where data values are color shaded from small to large
Learn more about using report builder in the User Manual.
Report printing
Capabilities of this feature include:
- Generate a printable view of reports from a web browser (WYSIWYG)
- Ability to export reports from a web browser to various file formats including csv, and html
- Print reports, including to pdf with system support
Benefits
For users:
- The new, more intuitive report wizard means that users are no longer need to have advanced knowledge of Splunk search commands to create the most commonly used tables and charts
- Greater flexibility in visualizing Splunk results makes data interpretation and analysis easier
- Advanced chart formatting options allows creating more visually attractive reports that can be shared with management without ever leaving Splunk
- Share reports with management or other colleagues
- Easily print or export charts and tables to include in other reports or materials
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.