Reporting

Do Reports contain results of past searches or are they only a reference to a saved search query?

koocies
Path Finder

I'm new to Splunk and I find Splunk reports confusing.

In other SIEMS a report is the results of a previously ran query. However, it seems to be that reports are saved search queries without results of previous runs. So, when I click a report name it seems to be rerunning the query and now showing results of a previous run.

Are my assumptions & understand of reports correct?

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's most common for a report to run a query and display the results.  It is possible, however, to create a report that displays the results of a previously-run saved search.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...