Reporting

Saving scheduled searches: what's the difference if it's saved as a report or as an alert?

MonkeyK
Builder

I have some scheduled queries for which the only purpose is to maintain a lookup table (or maybe summary index after I figure out how to do those).

Splunk only allows me to save these scheduled searches as either an alert or a report. Is there any advantage to choosing one over the other if I don't need reporting or alerting on the search?

0 Karma
1 Solution

lfedak_splunk
Splunk Employee
Splunk Employee
0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @MonkeyK, Check out this awesomely detailed explanation: https://answers.splunk.com/answers/187134/report-vs-alert-whats-the-difference.html

0 Karma

MonkeyK
Builder

Thank you lfedak. That explanation notes different workflows that can be built around a saved search. I was wondering if the was any reason to choose one over the other if I have no need for additional workflows?

For example, is there a performance consideration for choosing report or alert?

0 Karma

woodcock
Esteemed Legend

They are exactly the same thing but one allows you to tack on other things to the end. Just use a report and don't overthink this.

0 Karma

MonkeyK
Builder

Thanks woodcock. That was what I wanted to be sure of.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...