- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Re: Run a Scheduled Report on Demand
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Run a Scheduled Report on Demand
Guys, I have a scheduled report that is e-mail to about 10 people once weekly. Often though I'd like to trigger it on an ad-hoc basis so it gets sent again. Currently, I simply export the results to a PDF and e-mail it but this is a pain 🙂 How can I do send the report from Splunk by triggering it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can manually schedule a saved search via the command line.
This is the syntax that I currently use:
curl -k -u admin:password https://xx.xxx.xxx.xx:8089/servicesNS/admin/your_app_name_here/saved/searches/saved_search_name_here... -d schedule_time=2020-02-14T011:42:CST.
Worth noting:
The period after CST is required, it's not punctuation in this case.
The "reschedule" does not actually alter or impact the original configured schedule.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, below is the syntax to use if your saved search is not within the context of an app.
curl -k -u admin:password https://xx.xxx.xxx.xx:8089/servicesNS/admin/saved/searches/saved_search_name_here/reschedule -d schedule_time=2020-02-14T011:42:CST.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you found this advice helpfu, please accept the answer as it benefits the entire community, which is the goal.
An upvote would be appreciated and Accept Solution if it helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes so how do I do that...I don't see any cron options in the drop down for edit schedule
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can change the cron schedule, temporarily, to something in next 5-10 mins, wait for the alert to run successfully and revert back. Other option would be to add a sendemail command, with options matching your alert email setting (To,Cc,Subject, attachment etc) and run the search manually. I prefer the first one as it doesn't require additional testing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for your answer, so am i correct to assume that there is no way to do this in splunk directly? (ie there is no place or way to click run scheduled report now?)
tks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have the same question. it would be really nice to be able to click a button and have a report run from the Reports tab within an app. sometimes the scheduled search returns partial results or doesn't work at all (especially if there was an issue getting data indexed) and then the dashboard that uses a report is wrong. just being able to run the reports ad-hoc instead of rewriting the cron schedule would be much nicer.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
