Reports vs Saved Searches: Are saved searches and reports the same thing?

[POR160893]

Hi,

In Splunk, are saved searches and reports the same thing?


Thanks,
Patrick

[PickleRick]

Saved searches are reports and alerts. There used to be a distinctive functional difference ages ago as far as I read but now it's mostly a cosmetic difference that they are presented as different types in the ui.

If you call rest endpoint /services/saved/searches you'll get a list of both - reports and alerts - together.

[Hutch]

Reports and saved searches are pretty much the same thing. Reports are searches that have commands geared more towards reporting such as timechart and stats. You can also specify a time range that you would like the report to default to. If you need to modify the time frame you can simply click "open in search" and modify the time that way.