Documentation: 3.3
|  Print Version Contents
This page last updated: 07/09/08 02:07pm

Reports

Splunk allows you to summarize the results of any search as a report in a separate window.

You can access the reports window in three ways:

1. After running a search, click Report on results >> located below the search bar.

2. Select Report on this field >> from any interactive field filter menu.

3. Pipe your search results into a report command, such as stats, top, and rare.

We'll cover pipes and other commands in More searches.

Report on results

Let's build a report for all firewall deny events in sampledata:

1. Search for all firewall deny events in sampledata.

index=sampledata denySearch

2. After the results load, click Report on results >> above the timeline options. This takes you to a separate window where you can build your report.

Notice that:

  • You can enter new search strings from the search bar at the top of the window.
  • Splunk identifies fields from your search results and lists the field names in the Fields panel.

3. Select dst from the Fields list.

Splunk updates your search string to:

index=sampledata deny | top limit=100 dstSearch

The report displays:

  • A chart graphing the results (the top 100 values of dst).
  • A summary of the count and events matching your search.

http://www.splunk.com/assets/doc-images/3_2Reporting/dstReport1.png

Notice that the options in the Series panel defines the data series for your chart. You can also choose a different chart to display your results.

Let's tune this search to report only the top 10 dst values of firewall deny events and display the series in a pie graph.

4. In the search bar, change the limit boundary to 10 and enter the search:

index=sampledata deny | top limit=10 srcSearch

5. In the series panel, select display as "pie graph".

http://www.splunk.com/assets/doc-images/3_2Reporting/dstReport2.png

5. When you mouseover each wedge of the pie graph, an information box appears.
The box lists the dst value and event count. If you click on the wedge, Splunk takes you back to the search results and updates your search string to include the specific field name and value you selected from the chart. Try it out!

Report on fields

Return to the search window and search for all firewall deny events in sampledata.

index=sampledata denySearch

To report on fields:

1. Click on the Fields... menu.

2. From the list, check and apply src.

3. From the src filter menu, choose Report on this field >>.

http://www.splunk.com/assets/doc-images/3_2Reporting/srcMenu.png

Splunk takes you to the report window and updates your search string:

index=sampledata deny | top limit=100 srcSearch

Now, you can modify your report settings.

Build new reports

From the reports window, you can also enter a new search and build new reports.

1. Search for all "access_common" data in sampledata.

index=sampledata sourcetype=access_commonSearch

2. From the resulting list of Fields, select bytes.

3. Under Series, define your data series to "show the sum of bytes vs. time split by action":

http://www.splunk.com/assets/doc-images/3_2Reporting/byteReport.png

You can define a custom time range for your chart. Here, it's zoomed in to a day of data.

Note: The chart updates as you define your series.

Pick different charts

Change chart styles by selecting a type from the display as drop-down menu above the current chart. Choose from the following chart types:

  • column
  • line
  • area
  • scatter
  • stacked column
  • stacked area
  • pie
  • donut
  • bubble
  • heatmap

See a sample of these charts in the report gallery on our website.

Add a report to your dashboard

You can save a report just as you would any other search. When you save the search, add it to your default dashboard by checking the box at the bottom of the save dialog.

You'll see the report on the dashboard after clicking the logo to return to the home page. Dashboard searches are refreshed every tenth of the time interval (for example, a 4 hour search every 24 minutes) or every hour, whichever is shorter.

You can read more about saving searches to the dashboard in Manage saved searches.

Note: You won't see your report on your dashboard if you haven't loaded any data to your main index yet. As soon as you have data in your main index, the "getting started" links are replaced with a default dashboard including modules that are predefined in the product, plus additional searches and reports you've added.

Previous: Save options    |    Next: More searches

Comments

No comments have been submitted.

Log in to comment.