- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Re: How to enable an embedded report after I have ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If I embed a report when I create it, it's no problem.
But once it is a saved report or I have disabled embed to change the schedule, I cannot find a place to turn it back on. Advanced edit shows it as embed.enabled = 0.
But I cannot find the right flow of screens to actual embed it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The trick is that you need to be on the Reports page.
The settings -> searches, reports and alerts page does NOT allow you to embed.
1) So go to http:/yourserver/en-US/app/search/reports
2) find the report
3) Pull down Edit -> Edit Description, Edit Permissions... Embed
4) You will be asked to confirm if you want to Embed
I always edit my savedsearches and reports with the standard Settings -> searches, reports and Alerts. And was always lost finding Embed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The trick is that you need to be on the Reports page.
The settings -> searches, reports and alerts page does NOT allow you to embed.
1) So go to http:/yourserver/en-US/app/search/reports
2) find the report
3) Pull down Edit -> Edit Description, Edit Permissions... Embed
4) You will be asked to confirm if you want to Embed
I always edit my savedsearches and reports with the standard Settings -> searches, reports and Alerts. And was always lost finding Embed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What if Embed isn't in the Edit Pull down? Edit Description, Edit Permissions...is.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Saved a lot of headache, thanks a lot!
Shouldn't that be reported as a bug?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to disable the report that is embedded? Please help me.
Thanks in advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
burwell you are my hero! Take the rest of the week off!!! you cannot see it but I'm dancing around my desk !!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried to enable it through the original way in the report?
In the report, click edit>embed>enable report embedding
http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Embedscheduledreports
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
http://docs.splunk.com/Documentation/Splunk/6.3.5/Report/Embedscheduledreports
this is the doc for 6.3.5
the embed.enabled parameter is in savedsearches.conf. you should be able to change it there?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
test embeddedstats ke 2016-10-14 14:11:00 UTC None mexxxxx search 0 Private | Permissions Enabled | Disable View recent | Run | Advanced edit | Clone | Move | Delete
advanced edit does not allow me to update it.
Is that where you mean. I'm at 6.3.5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That was my point. It works when you build the report. However after it is built and saved or if I disable embed in the UI , the entry is not there to add back. the URL you gave does not apply in that case.
You "cannot get there from here" as best I can tell. Unless the expectation is to always edit the config file rather than use the UI.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you mouce hover over the disabled embed button, what message does Splunk show you?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry you need to tell me what screen I should be in to hover over embed because on my system I don't even see embed . It only seems to appear at creation time of report.
Do you mean the screen where I have a list of reports?
Do you mean select the specific report from the above screen?
At Version 6.3.5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
embed.enabled = 0 means it is off. Set it to 1 to turn it on.
To do it with the UI see the workflow in this post:
http://blogs.splunk.com/2014/05/08/17682/
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
