Save reports and share them with others

Save reports and share them with others

If you're happy with a new report that you've created, you have multiple options for saving it and sharing it with others.

Save reports or report results

There are two ways you can go when you select the Save drop-down list in the Format reports page of the Report Builder. You can save the report search string, time range, and associated formatting parameters so that you can run new reports based on those settings.

Or you can save the report results as a report job, so you can review the results of this specific run of the report at a later time.

Create a saved report

From the Formatting results page of the Report Builder, you can click Save and then select Save report... to save the report search string and associated content and formatting parameters with a unique name. The report will appear under that name in the Searches & Reports drop-down in the top-level navigation bar.

When you run a saved report, it creates a new report using the search string, time range, and chart formatting parameters that are associated with it. This is important to keep in mind, especially if you are planning to share the saved report with others or base dashboard panels on it. (Saved searches do not include chart formatting parameters--to capture these, generate a report based on the search, and save it instead.)

Note: To better find your report in the Searches & Reports drop-down, you might include the word "report" or "chart" in its title to distinguish it from searches. If you are saving a large number of reports, consider developing a naming strategy to make individual saved reports easy to find.

When you save a report you can also arrange for it to run on a schedule and even have it be part of an alert, which means, for example, that you could have the report be sent to you via email when certain conditions are fulfilled. For more information about scheduling reports and setting up alerts, see the topic "Monitor recurring situations" in this manual.

Note: Saved reports are a type of Splunk knowledge, along with saved searches, event types, tags, and other items that enrich your Splunk data and make it easier to do what you need to do with Splunk. When you first save a Splunk knowledge item, it is only available to you in the app that you're using when you create it. To make it available in the Searches & Reports dropdown to more users among multiple apps, you need to change who it is shared with and how it is promoted to other apps, if you have the permissions to do so.

For more information about making saved reports available to more users and promoting them among multiple apps, see "Perform actions on running and completed searches" in this manual.

Edit a saved report

You may find that you need to update a report after you've saved it. For example, you might want to fine-tune the search language that the report is based on. Or you may not like the way the report's chart displays, in which case you can adjust the chart formatting parameters for the report.

To edit a saved report, you first have to rerun the saved report (easily accomplished by selecting it from the top-level navigation of your app). When you rerun a saved report, Splunk automatically generates a chart based on it using the charting parameters that were set when the report was saved. To update search language and/or formatting parameters and then save your changes, select the Edit report button that appears near the top of the page:

The Report Builder appears, enabling you to update both the search language and the report formatting. When you're done, click Save and then select Save report (to update the original saved report with your changes) or Save report as... (to capture your updates in a new saved report with a different name). You can also select Save results only to just save the results of this particular run of the report (see below).

Note: If you run a saved report and it doesn't open in the Report Builder, but rather runs as a search using the search timeline, then it wasn't actually saved as a report with specific report formatting parameters. You'll need to save it as a report following the instructions in the subtopic above.

Save report results only

When you're on the Formatting results page of the Report Builder, you can click Save and select Save results only if you want to save the results of a particular run of a report, so you can review them at a later point in time. When you do this, you're saving a report "job," which you can access through the Jobs page.

If you tend to save a lot of jobs, you can save yourself some time looking for the job later in the Jobs page by selecting the Get link... button. This both saves the report job and gives you a direct link to the job. You can bookmark this link for future reference and/or share it with others.

For more information on managing search and report jobs on the Jobs page see "Supervise your search jobs" in this manual.

Managing saved report navigation

When you save a report, it should appear in one of the drop-down lists in the top-level navigation menu. In the Search app, for example, saved reports appear in the Searches & Reports list by default.

If you have write permissions for an app, you can change this default location, and even set things up so that reports with particular keywords in their names are automatically placed in specific categories in the navigation menu (so that Splunk automatically places reports with the word "website" in their name in a list of website-related searches and reports in the navigation menu. You can also move reports that have already been saved to the default list to different locations in the top-level navigation menu.

For more information, see "Define navigation for saved searches and reports" in the Knowledge Manager manual and "Customize navigation menus" in the Developer manual.

Share reports with others

There's no need to keep your completed reports to yourself if they contain useful information that should be seen by others. Splunk gives you a variety of ways to share them.

• Export the event data to a file. You can export the event data from your report to a csv, txt, json, or xml file. You can then archive this raw tabular data or input it into a third-party application such as MS Excel.
• Print the report. Splunk can send an image of the report you've created and its corresponding table straight to a printer, or save the report as a .pdf file depending upon available printer drivers.
• Set up delivery of .pdf report printouts with email alerts You can also arrange to have .pdf report printouts delivered with alert emails. For more information, see "Set conditions for scheduled searches" in this manual.
• Get (and share) a link to the results. Select Get link... to get a URL link to the report results. You can share this link with other interested parties, who can view it as long as they have access to your instance of Splunk.

Note: Selecting Get link... automatically saves your report job, which you can access thereafter through the Jobs page. The Get Link to Results popup window also includes a link that enables you to undo this save action.

Add reports to views and dashboards

It's also possible to design specialized views and dashboards that include reports that you've defined. Dashboards can be made up of multiple panels that each display charts, lists, and other data that are generated by hidden, predefined searches.

Splunk provides a visual dashboard editor that enables you to quickly create simple dashboards. For more information, see "Create simple dashboards with the dashboard editor" in this manual. For information about creating views and more sophisticated dashboards, see the Developer manual.