Reporting

Saving scheduled searches: what's the difference if it's saved as a report or as an alert?

MonkeyK
Builder

I have some scheduled queries for which the only purpose is to maintain a lookup table (or maybe summary index after I figure out how to do those).

Splunk only allows me to save these scheduled searches as either an alert or a report. Is there any advantage to choosing one over the other if I don't need reporting or alerting on the search?

0 Karma
1 Solution

lfedak_splunk
Splunk Employee
Splunk Employee
0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @MonkeyK, Check out this awesomely detailed explanation: https://answers.splunk.com/answers/187134/report-vs-alert-whats-the-difference.html

0 Karma

MonkeyK
Builder

Thank you lfedak. That explanation notes different workflows that can be built around a saved search. I was wondering if the was any reason to choose one over the other if I have no need for additional workflows?

For example, is there a performance consideration for choosing report or alert?

0 Karma

woodcock
Esteemed Legend

They are exactly the same thing but one allows you to tack on other things to the end. Just use a report and don't overthink this.

0 Karma

MonkeyK
Builder

Thanks woodcock. That was what I wanted to be sure of.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...