About saving and sharing reports
In the last section you learned the basics of searching in Splunk Enterprise, how to use a subsearch, and how to add field from lookup tables. This section takes you through saving searches and more search examples.
Save as a report
Run the previous search again and save it as a report.
sourcetype=access_* status=200 action=purchase [search sourcetype=access_* status=200 action=purchase | top limit=1 clientip | table clientip] | stats count AS "Total Purchased", dc(productId) AS "Total Products", values(productName) AS "Product Names" by clientip | rename clientip AS "VIP Customer"
1. To save it as a report, click Save as above the search bar and select Report.
This opens the Save as Report dialog.
2. Enter a Title VIP Customer.
3. (Optional) Enter a Description Bettercup Games most frequent shopper.
4. Because the report is a table, for Visualization, click None.
5. To include a Time Range Picker, click Yes.
6. Click Save.
The Your report has been created dialog box opens.
There are other options in this window.
- Continue Editing lets you refine the search and report format.
- Add to dashboard lets you add the report to a new or existing dashboard.
- View lets you view the report.
7. Click View.
You can access your saved reports using the app navigation bar.
1. Click Reports to open the Reports listing page.
When you save a new report, its Permissions are set to "Private". This means that only you can view and edit the report. You can allow other apps to view, or edit, or view and edit the reports by changing its Permissions.
1. Under Actions, click Edit and select Edit Permissions.
This opens the Edit Permissions dialog box.
2. Click App and check the box under Read for Everyone.
This action gives everyone who has access to this app the permission to view it.
3. Click Save.
Back at the Reports listing page, you see that the Sharing for VIP Customer now reads App.
View and edit saved reports
You can open saved reports using the Reports listing page.
1. Click VIP Customer to open that report.
You saved this report with a time range picker, which is located to the top left. The time range picker lets you change the time period to run this search. For example, you can use this time range picker to run this search for the VIP Customer Yesterday, the day before, or last month just by selecting the Preset time range or defining a custom time range. See "About the time range picker".
About report acceleration
If your search has a large number of events and is slow to finish, you might be able to accelerate the resulting report so it finishes faster when you run it again. This option is available when the report produced by your search qualifies for acceleration. The "VIP Customer" report does not qualify for acceleration, because it is based on a transforming search.
The sample data used in this tutorial is limited in volume and the searches throughout are run against data for one day (Yesterday). Checking this box will not affect the speed of this search and all upcoming searches you save in this Tutorial.
Read more about report acceleration and the kinds of searches that enable reports to qualify for report acceleration in the "Accelerate Reports" topic in the Reporting manual.
Continue to run more search examples and save more reports.
Use field lookups
More searches and reports
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1.13, 6.1.14