topic Re: Change report query in Reporting

Change report query

jxjackso — Mon, 08 Jun 2020 20:37:15 GMT

Is it possible to change the query for a report and save it with the original name? When I tru to do so, Splunk gives me an error that the report already exists.

The reason I want to edit this particular report is that I need to exclude the ip of my load balancer since it performs health checks every 5 seconds. I'd like to do so without having to save the altered report to a new one, deleting the existing report, then cloning the new report to the same name as the old one.

Re: Change report query

Paolo_Prigione — Thu, 15 Jul 2010 23:01:55 GMT

Hi, you should be able to do so through the Manager:

Manager->Searches and reports->Edit

make sure you under the proper application while doing it.

Re: Change report query

ftk — Thu, 15 Jul 2010 23:10:45 GMT

You have two options:

Via the webinterface, go to Manager > Searches and reports and track down your search. If you know the name of the search you can even search for it. Click the name of the search you want to edit. Edit the search in the Search box and click Save. All done!
Look for savedsearches.conf. This may be in one of many locations, depending on the owner and sharing permissions you have set for the search. Look in the following directories: $SPLUNK_HOME/etc/search/local/, $SPLUNK_HOME/etc/apps/my_custom_app/local/, $SPLUNK_HOME/etc/users/user_name/search/local/. Once you have found the correct file, just look for the saved search you want to edit and modify the search = line to edit the search.

Re: Change report query

jxjackso — Thu, 15 Jul 2010 23:30:08 GMT

Both of you, thanks for the answer.

What confused me was the existence of the "Edit Report" button.
That button name implies you can modify the report. Which is partly true. You can change graphing options, labels, etc and hit apply to save those changes. But you can't save a new query from the "Edit Report" button. Maybe when you hit edit report, there should be a link or something that can take you to the manager page where you edit the report query.

Either way, you guys answered my question. Thanks.

Re: Change report query

hbazan — Thu, 15 Jul 2010 23:31:10 GMT

When you open a saved report (using .../report_builder_display?...) you've got several button s above the results (Export / Print / ... / Edit Report). The Edit Report option opens the report editor on a new window, and there you got the "Save" or "Save as" options. But I've found that if you change a number of things, the Save option disappear (for instance going back and forth between "define report" and "format Report").

Re: Change report query

kmugglet — Wed, 15 Jan 2014 00:52:40 GMT

Stating the Obvious. For version 6, replace Manager with Settings.

Re: Change report query

kintax — Tue, 19 Dec 2017 16:30:34 GMT

Hi. I don't see anything called "Manager" nor can I find any other way of editing a report query and saving it as the same report. Has this changed since 2010?,Can this please be updated for a current version of Splunk? I don't see any way to edit the query used for the report and I don't see anything called "Manager" Really wish there was an "Edit Report" function that let you do what it said it did.

Re: Change report query

jeanneraymond — Thu, 11 Oct 2018 18:49:36 GMT

You have to rerun the report for the "Save" button to be enabled. For example, on the Reports page, click "Open in Search" make your changes to the query, then click the Search (magnifying glass) icon to run the revised query. The "Save" button should then be enabled.

Re: Change report query

kramerthefirst — Fri, 17 Apr 2020 15:00:11 GMT

I don't see any Manager link either. Could someone please clarify?

Re: Change report query

kramerthefirst — Fri, 17 Apr 2020 15:03:14 GMT

Never mind. In my Splunk version, it's apparently called settings. Thanks!