Splunk® Enterprise

Reporting Manual

Download manual as PDF

Download topic as PDF

Create and edit reports

When you create a search or a pivot that you would like to run again or share with others, you can save it as a report. This means that you can create reports from both the Search and the Pivot sides of the Splunk platform.

Once you create a report you can:

  • View the results that the report returns on the report viewing page. You can get to the viewing page for a report by clicking the name of the report on the Reports listing page.
  • Open the report and edit it so that it returns different data or displays its data in a different manner. Your report opens in either Pivot or Search, depending on how it was created.

In addition, if your permissions enable you to do so, you can:

  • Change the report permissions to share it with other Splunk users. See Set report permissions, in this manual.
  • Schedule the report so that it runs on a regular interval. Scheduled reports can perform actions each time they run, such as sending report results via email to a set of stakeholders. See Schedule reports, in this manual.
  • Accelerate slow-completing reports built in Search. See Accelerate reports, in this manual.
  • Embed scheduled reports in external websites. See Embed scheduled reports, in this manual.
  • Add the report to a dashboard as a dashboard panel. see Add a search, report, or pivot to a dashboard in the Dashboards and Visualizations manual.

Note: Permissions for reports built via Pivot must match those of the data model that was used to construct them. See "Permissions for Pivot-based reports,", in this manual.

Manually create a report in Splunk Web

You can create reports via Splunk Web four ways:

  • From Search, by saving a search as a report.
  • From Pivot, by saving a pivot as a report.
  • By navigating to Settings > Searches, reports, and alerts and clicking New to add a new report.
  • From a dashboard, by converting an inline-search-powered dashboard panel to a report.

See the following subsections for more information about these report creation methods.

At minimum, a report definition includes the search string and the time range associated with the search (expressed in terms of relative time modifiers). You also have to give the report a name so you can identify it in the Reports listing page and the Searches and reports page in Settings.

Save a search or pivot as a report from the Search or Pivot views

When you design a search or pivot that returns useful results, you can save it as a report. The report retains any formatting that you set up for the original search, including chart visualizations and event list display options.

Note: You can only save a search as a report when it is running, paused, finalized, or completed.

  1. Run a search or design a pivot that is worth saving as a report.
  2. Click Save As and select Report. to save the search or pivot as a report. The report retains any formatting that you set up for the original search, including chart visualizations and event list display options.
  3. Provide a unique Title for the report.
    6 4 0 save search as report.png
  4. (Optional) Provide a Description of the report.
  5. (Optional) Add a time range picker to the report. A time range picker allows users without write permissions to rerun the report over a different time range without actually editing it.

    If you do not provide a time range picker, the report always runs over the same time range as the original search. To change the time range, a user with edit permissions for the report must open it in Search, update its time range, and save that edit.

    Note: The time range picker option is unavailable for scheduled reports, which always display the results returned by their last scheduled run. If you schedule a report that has a time range picker, the time range picker disappears. See Schedule reports, in this manual.

  6. Click Save to save the search as a report.

When you save a search as a report, you can:

Create a new report in Settings

When you want to create a report, in general the easiest thing to do is run the search or pivot and then save it as a report, as described above. This method enables you to test the search before you save it.

However, you can also manually create new reports in Settings.

  1. Navigate to Settings > Searches, reports, and alerts and click New to define and add a new report.

    When you define a report in Settings, you set it up as a "saved search." This search appears as a report on the Reports listing page when you're done (or on the Alerts listing page, if you configure it as an alert).
    Em settings add new search.png

  2. Provide a Destination app for the search. This setting defaults to your current app context.
  3. Give the search a Search name that is unique to the destination app.
  4. In the Search field, provide the search string.
  5. (Optional) Provide a search description.
  6. (Optional) Determine whether the search should run as Owner or run as User.

    This setting determines whether the search runs with the permissions of the search Owner (the person who defined the search) or the permissions of the search User (the person who is running the search). Reports run as Owner by default. See Determine whether to run reports as the report owner or report user, in this manual.

  7. Provide the search Start time and Finish time using relative time modifiers. If you want the search to run over all time, leave Start time and Finish time blank.
  8. (Optional) If your permissions enable you to do so, set up report acceleration for the search by selecting Accelerate this search and choosing an appropriate Summary range.

    Report acceleration enables a search that is normally slow to complete to complete much faster on future runs. See Accelerate reports, in this manual. Only specific types of searches qualify for report acceleration.

  9. (Optional) If you want to define this search as a scheduled report or alert, and your permissions enable you to do so, select Schedule this search.

    For more information about defining scheduled reports (reports that run on a schedule and which send search results via email or launch a script each time they run), see Schedule reports in this manual.

    For more information about defining alerts, see the Alerting Manual.

  10. (Optional) Enable summary indexing for the search.

    Summary indexing is a method of search acceleration. See Use summary indexing for increased reporting efficiency, in the Knowledge Manager Manual.

  11. Click Save to save your report.

You can edit and update searches listed on the Searches, Reports and Alerts page if you have "write" permissions for them. See Manage knowledge object permissions in the Knowledge Manager Manual.

Preview your saved search

You can preview a search before running it by using search expansion. Search expansion allows you to preview your search by expanding the entire search, including saved searches, without running the search.

Prerequisites

Steps

  1. Navigate to the Splunk Search page.
  2. In the Search bar, type the default report Errors in the last 24 hours.
  3. Open search expansion by using the keyboard shortcut Command-Shift-E (Mac OSX) or Control-Shift-E (Linux or Windows).
    The search expansion preview shows syntax highlighting and line numbers, if those features are turned on.
    This screen image shows the expanded search string with the default saved search (Errors in the last 24 hours).
  4. (Optional) Copy a fragment of the search.
  5. (Optional) Run your search by clicking Open in Search.

A window opens with your expanded search.

Convert a dashboard panel inline search to a report

If you work with Splunk dashboards, you may know that the dashboard panels can be "powered" by inline searches or reports. There are advantages to both panel types.

Panel type Creation methods Advantages of
Backed by inline search (search string in panel definition)
  • Save a new search or pivot as a dashboard panel.
  • Open an existing report in Search or Pivot (see "Edit a report," below) and save it as a dashboard panel that is backed by an inline search.
  • Create a panel from within the dashboard editor, choose Inline search, and define the search string.
You can edit the search that backs the panel without leaving the dashboard editor.
Backed by report
  • Open an existing report in Search or Pivot (see "Edit a report," below) and then save it as a dashboard panel that is backed by a report.
  • Create a panel from within the dashboard panel, choose Report, and select a report name.
  • Can take advantage of report acceleration, so the panel loads faster.
  • If the report is scheduled, can instantly display the results from the last scheduled report run.

You can easily convert the inline search in a dashboard panel definition to a report, thus converting the panel to a report-backed panel. When you do this, the new report is added to the Reports listing page and the Searches, Reports, and Alerts page in Settings. You can also define acceleration, scheduling, and permissions settings for the report that powers the panel.

For more information about how dashboard panels are created and how they end up with inline searches, see "Add panels to dashboards" in the Dashboards and Visualizations manual.

Dashboard panels based on reports can have different formatting than the reports they're associated with. See "Have a dashboard panel take on the formatting of its affiliated report," in this topic.

To convert a dashboard panel to a report

1. Locate the dashboard that you want to convert and click Edit.

Icons appear at the upper right corner of each panel in the dashboard.

2. Click the Panel Properties icon for a panel based on a search or pivot and select Convert to Report.

The Panel Properties icon is the leftmost of the three panel editing icons mentioned in the previous step. Its icon indicates the panel's document type--a magnifying glass for a panel based on a search, pivoting arrows for a pivot, or a sheet of paper for a search- or pivot-based report.
The Save panel as report dialog appears.

6.0 dashpanel convert2report 1.png

3. (Optional) Provide a different Title and Description for the report than the title and description associated with the panel.

6.0 dashpanel convert2report 2.png

4. Click Save.

Splunk software adds the new report to the Reports listing page.

Have a dashboard panel take on the formatting of its affiliated report

If you convert a dashboard panel to a report and then edit the report so it uses a different visualization or has different visualization formatting, your changes will not automatically be reflected in the affiliated panel. To sync up the dashboard panel with the updated report, follow these steps:

1. Click Edit for the dashboard that contains the panel you'd like to update.

2. Click the Panel Properties icon for the panel you'd like to update.

3. Select the panel/report name (the name only appears for panels that have already been converted to a report).

A report info screen appears. Here you can edit various aspects of the report (permissions, acceleration, scheduling, and so on) if your permissions enable you to do so.

6.0 dashpanel report select.png

4. Click Use Report Formatting on Visualization and confirm that you want the panel to use the report's formatting.

This causes the panel to use the visualization type and formatting that you have defined for the report. For example, if the panel displays a pie chart, but the report associated with the panel is configured to display its data as a column chart, click Use Report Formatting on Visualization. This makes the panel display the data in the form of a column chart.

6.0 dashpanel reportviz select 2.png

In a similar manner, you can make the panel use the data and formatting of an entirely different report. Follow the steps above but click Select New Report instead of Use Report Formatting on Visualization. This opens the Select a New Report dialog. Choose a different report, click save, and the panel updates to display data visualized according to the selected report.

Note: If the inline dashboard panel derives from a pivot, you lose the ability to change the panel visualization type via the dashboard when you convert it to a report.

Your permissions determine what reports you can choose and edit.

Edit a report

You can easily edit an existing report. You can edit a report's definition (its search string, pivot setup, or result formatting). You can also edit its description, permissions, schedule, and acceleration settings.

To edit a report's definition

If you want to edit a report's definition, there are two ways to start, depending on whether you're on the Reports listing page or looking at the report itself.

  • If you're on the Reports listing page, locate the report you want to edit, go to the Actions column, and click Open in Search or Open in Pivot (you'll see one or the other depending on which tool you used to create the report).
  • If you've entered the report to review its results, click Edit and select Open in Search or Open in Pivot (you'll see one or the other depending on which tool you used to create the report).

Edit the definition of a report opened in Search

After you open a report in search, you can change the search string, time range, or report formatting. After you rerun the report, a Save button will be enabled towards the upper right of the report. Click this to save the report. You also have the option of saving your edited search as a new report.

Edit the definition of a report opened in Pivot

After you open a report in Pivot, change the definition of the pivot as you would like. You can add, remove, or redefine filters, split rows, split columns, or column values. You can also change the way the pivot results are formatted (change the visualization type, or fix the way a chart displays). When you are done, click Save at the upper right of the page to save your report. You also have the option of saving your edited pivot as a new report.

To edit a report's description, permissions, schedule, and acceleration settings

You can do this from the Reports listing page, or from the report viewing page. Click Edit and choose:

  • Edit Description to change the name and description of the report.
  • Edit Permissions to change the report permissions. See Set report permissions, in this manual.
  • Edit Schedule to schedule the report or change the report schedule if it already has one. See Schedule reports, in this manual.
  • Edit Acceleration to change the way the report is accelerated. Note: This option is only available for certain kinds of reports created in Search. See Accelerate reports, in this manual.

Note: You can't perform these actions if you've opened the report in Search or Pivot. Save the report or return to the Reports listing page if you want to edit these aspects of the report.

Clone a report

Report cloning is a way to quickly create a report that is based on an existing report. You can then give the clone a unique name and edit it so it returns different results.

Note: You can't perform this action if you've opened the report in Search or Pivot. Save the report or return to the Reports listing page if you want to clone it.

Caution: Do not give your cloned report the same name and search string as the original report. If you do this, you create a situation where the original report and the cloned report are linked together. This means that the original report must exist in order for its clone to exist. If you delete the original report, the linked clone report disappears with it.

If you keep your clone private, you might give it the same name as its source report to take advantage of this link. When a user updates the original report, Splunk software updates the linked private customized clone as well.

1. Open the Reports listing page.

2. Locate a report that you want to clone and click its Edit link.

3. From the list that appears, select Clone.

The Clone window appears.

4. For New Title, provide a unique name for the cloned report.

Splunk software gives the cloned report the name of the original report plus the word "Clone." We recommend that you give the cloned report a unique name, especially if you plan to share it with other users.

5. (Optional) Give the cloned report a Description and set its Permissions.

Leave the Permissions set to Private if you do not want to share the cloned report with anyone else. Select Clone if you want the cloned report to have the same permissions as the original report.

6. Click Clone report to clone the report. The cloned report now appears on the Reports listing page.

Disable a report

If your permissions allow it, you can disable a report. When a report is disabled, it continues to appear in the Report listings page and in Searches, Reports, and Alerts, but it cannot be run.

You typically use this feature to disable scheduled reports. This means they cease to run on their schedule, but still exist in the system with their schedule definitions intact. You can enable a disabled scheduled report when you want it to run on its schedule again.

  1. Navigate to Settings > Searches, Reports, and Alerts.
  2. Locate the search you want to disable and click its Disable link.

If you try to run a disabled report you will see an error message. If your permissions allow it, the message includes an Enable Report button that you can use to enable the disabled report and an Open in Search button that you can use to run the search string used by the report.

Delete a report

You can delete a report from the Reports listing page or the report viewing page. Just click Edit and select Delete. Most roles can only delete reports that they have created. For more information about granting roles the ability to delete reports that they do not own, see Disable or delete knowledge objects, in the Knowledge Manager Manual.

Note: You can't perform this action if you've opened the report in Search or Pivot. Save the report or return to the Reports listing page if you want to edit these aspects of the report.

Configure a report in savedsearches.conf (Splunk Enterprise)

When you save a report via Splunk Web or Settings, Splunk software automatically adds a configuration stanza for that report to savedsearches.conf. The UI validates your changes, and you don't have to reboot the system to apply reports created via UI methods. But if you have Splunk Enterprise and prefer to work with reports directly through configuration files, you certainly can.

For more information about configuring reports and alerts in savedsearches.conf, see the spec file for savedsearches.conf and the Configure alerts in savedsearches.conf topic in the Alerting Manual.

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has around reports.

PREVIOUS
About reports
  NEXT
Set report permissions

This documentation applies to the following versions of Splunk® Enterprise: 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 7.0.0, 7.0.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters