Reporting

How do you publish a Splunk real-time report?

nageshs
Engager

So I have a real-time report working. I have created a new user whom I want to be able to view (and only view) the report - no changes to settings, etc. How do you publish this? For example, if I was developing a report on BIRT, then I could probably share a URL of the report published to the underlying Tomcat or whatever. In Splunk, I did see there is an option to share the job. But, that URL turns up again as if it was a development IDE. Whereas, I would like to display the real-time report on a large device like a 42" LED TV.

So, how does one publish a Splunk report?

Tags (3)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

You can use embedded reports, but on a scheduled basis and not with a real-time search. Are you sure you need a real-time search? Typically, data that you want humans to look at is fine refreshed every minute or five.

View solution in original post

pramit46
Contributor

Real time puts a little stress on the system, and since your application updates in every 5 minutes, why not hitting a scheduled search in every 5 minute and look for the data for last 5 minutes. Try this simple cron to trigger the job in every 5 min.
*/5 * * * *

0 Karma

ChrisG
Splunk Employee
Splunk Employee

You can use embedded reports, but on a scheduled basis and not with a real-time search. Are you sure you need a real-time search? Typically, data that you want humans to look at is fine refreshed every minute or five.

View solution in original post

nageshs
Engager

The frequency of my real time search would not be very less; maybe, 1 update in 5 minutes or so. So, yes, a real-time report would be good.

0 Karma

nageshs
Engager

I am able to embed a scheduled report - scheduled to run every 5 mins. Thanks !

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!