Reporting

Are time range pickers valid in reports? Also when running saved reports, do they run new updated data or run the same result as when saved?

dannyze
Explorer

For clarification on second half of my question, I've had problems on running saved reports and having to adjust settings. Does this mean it does not run a fresh search?

0 Karma

@dannyze, time range picker are available in Reports, while saving a Splunk Search as a report you should be able to see the option to add Time Range Picker.

Ideally report should show updated information every time you run. However, that also depends on the time range you have picked for the search. For example if it was Yesterday (i.e. dispatch.earliest_time = -1d@D
dispatch.latest_time = -0d@d
), then results will not change until the day changes. If it is something like last 15 minutes (i.e. dispatch.earliest_time = -15m dispatch.latest_time = now), then it should update every time you run.

If you have scheduled the search then the result will not changes until the next iteration is run. For example following is a report cron schedule to run every 15 minutes : cron_schedule = */15 0 * * *.
Please let us know if it addresses the needs or not.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

dannyze
Explorer

Yes, I wanted to confirm time range picker was a built in option thank you

0 Karma

@dannyze, I have converted to answer. Please accept to mark as answered.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...