About reports and charts

About reports and charts

Using Splunk's powerful IT search capabilities to investigate issues and gather important knowledge about your enterprise is only the first part of the overall equation. Draw on Splunk's ability to swiftly analyze the information you uncover through your searches and use it to create compelling visualizations in the form of reports and charts.

In this chapter you will:

• See a primer on the use of reporting commands.
• Discover how Splunk's report builder makes the definition, generation, and formatting of sophisticated reports a snap.
• Find a handy reference for the different kinds of reports and charts that you can create.
• Learn how your enterprise can design dashboard views containing charts that display data critical to your day-to-day business processes.
• Learn about summary indexing, which can increase reporting efficiency if you're working with large amounts of data on a regular basis.

Launching the Report Builder

When you initiate a search, you'll see a Build report link in the job status bar above the the timeline. To launch the Report Builder, which you can use to define, generate, and fine-tune the formatting of your report, click this link.

Note: You can start building your report before the search completes. Splunk can dynamically update generated charts as it gathers search results.

Alternatively, you can access the Report Builder by:

• Clicking Build report in the Actions dropdown menu after you initiate a search.
• Clicking a field in the search results sidebar to bring up the interactive menu for that field. Depending on the type of field you've clicked, you'll see links to reports in the interactive menu such as average over time, maximum value over time, and minimum value over time (if you've selected a numerical field) or top values over time and top values overall (if you've selected a non-numerical field). Click on one of these links, and Splunk opens the Format report page of the Report Builder, where it generates the chart described by the link.

Note: If your search string includes reporting commands, you access the Report Builder by clicking Show report. Splunk will jump you directly to the formatting stage of the report-building process, since your reporting commands have already defined the report.

You don't need to have a strong understanding of reporting commands to use the Report Builder, but if you do have this knowledge the range of things you can do with the Report builder is increased.

Splunk displays the Report Builder in a pop-up window, so you can easily return to the search page and review your search results as you refine your reporting parameters.

To learn more about using the report builder to define basic report parameters, format charts, and export or print finished reports, see "Define reports and generate charts" in this manual.

Note: Keep in mind that report jobs are only preserved in the system for a set period of time. If you do not save them, they eventually expire, and you cannot generate reports for expired report jobs. For more information about job management, see "Supervise your search jobs" in this manual.

If you want to save a report job, select Save results only from the Save menu on the Report formatting page of the Report Builder.