Splunk® Enterprise

Search Tutorial

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

About saving and sharing reports

In the last section you learned the basics of searching in Splunk Enterprise, how to use a subsearch, and how to add field from lookup tables. This section takes you through saving searches and more search examples.

Save as a report

Run the previous search again and save it as a report.

sourcetype=access_* status=200 action=purchase [search sourcetype=access_* status=200 action=purchase | top limit=1 clientip | table clientip] | stats count AS "Total Purchased", dc(productId) AS "Total Products", values(productName) AS "Product Names" by clientip | rename clientip AS "VIP Customer"

1. To save it as a report, click Save as above the search bar and select Report.

Search tutorial saveas report1.png

This opens the Save as Report dialog.

2. Enter a Title VIP Customer.

3. (Optional) Enter a Description Bettercup Games most frequent shopper.

Search tutorial saveas report2.png

4. Because the report is a table, for Visualization, click None.

5. To include a Time Range Picker, click Yes.

6. Click Save.

The Your report has been created dialog box opens.

There are other options in this window.

  • Continue Editing lets you refine the search and report format.
  • Add to dashboard lets you add the report to a new or existing dashboard.
  • View lets you view the report.

7. Click View.

Find and share saved reports

You can access your saved reports using the app navigation bar.

1. Click Reports to open the Reports listing page.

Search tutorial saved reports listing.png

When you save a new report, its Permissions are set to "Private". This means that only you can view and edit the report. You can allow other apps to view, or edit, or view and edit the reports by changing its Permissions.

1. Under Actions, click Edit and select Edit Permissions.

Search tutorial reports edit permissions.png

This opens the Edit Permissions dialog box.

2. Click App and check the box under Read for Everyone.

Search tutorial reports edit permissions2.png

This action gives everyone who has access to this app the permission to view it.

3. Click Save.

Back at the Reports listing page, you see that the Sharing for VIP Customer now reads App.

View and edit saved reports

You can open saved reports using the Reports listing page.

1. Click VIP Customer to open that report.

Search tutorial edit report.png

You saved this report with a time range picker, which is located to the top left. The time range picker lets you change the time period to run this search. For example, you can use this time range picker to run this search for the VIP Customer Yesterday, the day before, or last month just by selecting the Preset time range or defining a custom time range. See "About the time range picker".

About report acceleration

If your search has a large number of events and is slow to finish, you might be able to accelerate the resulting report so it finishes faster when you run it again. This option is available when the report produced by your search qualifies for acceleration. The "VIP Customer" report does not qualify for acceleration, because it is based on a transforming search.

The sample data used in this tutorial is limited in volume and the searches throughout are run against data for one day (Yesterday). Checking this box will not affect the speed of this search and all upcoming searches you save in this Tutorial.

Read more about report acceleration and the kinds of searches that enable reports to qualify for report acceleration in the "Accelerate Reports" topic in the Reporting manual.

Next steps

Continue to run more search examples and save more reports.

Use field lookups
More searches and reports

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1.13, 6.1.14

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters