Save reports or report results
You have three choices when you click the green Save button in the Format reports page of the Report Builder. You can:
- save the report search string, time range, and associated formatting parameters, so that you can run new reports based on those settings.
- save the search results as a report job, so you can review the results of this specific run of the report at a later time.
- save the report results as a report job and create a URL to share, so that other Splunk users can see the results.
Create a saved report
From the Format report page of the Report Builder, click Save and then select Save report... to open the Save Report dialog. Save Report enables you to save the report search string and associated content and formatting parameters with a unique name. You can also change the time range for the report if necessary. After you save the report, it will appear under Searches & Reports in the top-level navigation bar, using the unique name that you assigned to it.
Note: To make it easier to find your report in the Searches & Reports list, you might include the word "report" or "chart" in its title to distinguish it from searches. If you are saving a large number of reports, consider developing a naming strategy to make individual saved reports easy to find.
When you run a saved report, it creates a new report using the search string, time range, and chart formatting parameters (the chart type, chart title, legend placement, and so on) that are associated with the original report. This is important to keep in mind, especially if you are planning to share the saved report with others or base dashboard panels on it . (Saved searches do not include chart formatting parameters--to capture these, generate a report based on the search, and save it instead.)
Note: Saved reports are a type of Splunk knowledge object, along with saved searches, event types, tags, and other items that enrich your Splunk data and make it easier to do what you need to do with Splunk. When you first save a Splunk knowledge object, it is only available to you in the app that you're using when you create it. If you have the privileges to do so Save > Save report enables you to share the report with all the users of the app you're currently using, with read-only access.
If you have the ability to set search and report object permissions, you can enable other kinds of access to your saved reports through Manager > Searches and reports, including sharing them with users in multiple apps and giving users write access so they can update saved report definitions. For more information, see "Curate Splunk knowledge with Manager" in the Knowledge Manager Manual.
Edit a saved report
You might find that you need to update a report after you've saved it. For example, you might want to fine-tune the search language that the report is based on. Or you may not like the way the report's chart displays, in which case you can adjust the chart formatting parameters for the report.
To edit a saved report:
1. First, rerun the saved report by choosing it from the Searches & Reports menu in the top navigation bar in Splunk Web. When you rerun a saved report, Splunk opens it in the Report Builder and generates a chart that is based on a new search job but is constructed using the chart formatting parameters that were saved as part of the report definition. 2. To update the report's search string, or update its chart formatting parameters, click Edit report near the top left of the page:
3. The Report Builder opens with the Format report page displayed. If you want to edit the search itself, click Define report content at the top left. 4. When you're done, click Save > Save report (to update the original saved report with your changes) or Save report as... (to capture your updates in a new saved report with a different name). You can also select Save results only to just save the results of this particular run of the report (see "Save report results only," below, for more information).
Note: If you run a saved report and it doesn't open in the Report Builder, but rather runs as a search using the search timeline, then it wasn't actually saved as a report with specific report formatting parameters. You'll need to save it as a report following the instructions in the subtopic above.
Save report results only
When you're on the Format results page of the Report Builder, you can click Save > Save results if you want to save the results of a particular run of a report, so you can review them at a later time. When you do this, you're saving a report "job," which you can access through the Jobs page.
For more information on managing search and report jobs on the Jobs page see "Supervise your search jobs" in this manual.
When you save a report, it should appear in one of the menus in the top-level navigation bar in Splunk Web. In the Search app, for example, saved reports appear in the Searches & Reports menu by default.
If you have write permissions for an app, you can change this default location, and even set things up so that reports with particular keywords in their names are automatically placed in specific categories in the navigation menu (for example, so that Splunk automatically places reports with the word "website" in their name in a list of website-related searches and reports in the navigation menu). You can also move reports that have already been saved to the default list to different locations in the top-level navigation menu.
For more information, see "Define navigation for saved searches and reports" in the Knowledge Manager manual and "Customize navigation menus" in the Developer manual.
There's no need to keep your completed reports to yourself if they contain useful information that others should see. Splunk gives you a variety of ways to share them.
- Export the event data to a file. You can export the event data from your report to a CSV, XML, or JSON file. You can then archive this raw tabular data or input it into a third-party application such as MS Excel. To export event data, click Export in the Table section of the report.
- Print the report. Splunk can send an image of the report you've created and its corresponding table straight to a printer, or save the report as a .pdf file depending upon available printer drivers. To print the report, click the blue Print icon at the top right of the report.
- Set up delivery of .pdf report printouts with email alerts You can also arrange to have .pdf report printouts delivered with alert emails. For more information, see "Create an alert" in this manual.
- Get (and share) a link to the results. Select Save > Save and share results to get a URL link to the report results. You can share this link with other interested parties, who can view it as long as they have access to your instance of Splunk.
Add reports to views and dashboards
It's also possible to design specialized views and dashboards that include reports that you've defined. Dashboards can be made up of multiple panels that each display charts, lists, and other data that are generated by searches. You can associate your saved reports with these dashboard panels.
Splunk provides a dashboard editor that enables you to quickly create simple dashboards. For more information, see "Create simple dashboards with the dashboard editor" in this manual. For information about creating views and more sophisticated dashboards, see the Developer manual.
Splunk default dashboards
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7