topic Re: Why is the save button greyed out when attempting to modify a report/search? in Splunk Search

Why is the save button greyed out when attempting to modify a report/search?

infra2sec — Wed, 04 May 2016 12:54:51 GMT

Hello,

I am new at this and I have been emailed some search examples to meet an objective. I copied and pasted the search into Splunk and saved it as a report. I'd like to modify the search as I learn. The only option that is available to me is to do a "save as". The save option is greyed out.

Any idea why the save button would be greyed out assuming I have permissions e.g. r/w to my own report?

Thanks!

Re: Why is the save button greyed out when attempting to modify a report/search?

infra2sec — Thu, 05 May 2016 13:45:01 GMT

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

Re: Why is the save button greyed out when attempting to modify a report/search?

jcorcoran508 — Mon, 13 Jul 2020 19:58:28 GMT

I know its a dated string. On splunk 8, when you edit a Report via open search in the report window.

you will see the "SAVE" button greyed out. Modify the search string (if that is you intent) , click the search button.

So post change run you see the "SAVE" button be normal , then save the report as the same name.

Or Save as for a new named report using the updated search string.