Reporting

Saving scheduled searches: what's the difference if it's saved as a report or as an alert?

Builder

I have some scheduled queries for which the only purpose is to maintain a lookup table (or maybe summary index after I figure out how to do those).

Splunk only allows me to save these scheduled searches as either an alert or a report. Is there any advantage to choosing one over the other if I don't need reporting or alerting on the search?

0 Karma
1 Solution

Splunk Employee
Splunk Employee
0 Karma

Splunk Employee
Splunk Employee
0 Karma

Builder

Thank you lfedak. That explanation notes different workflows that can be built around a saved search. I was wondering if the was any reason to choose one over the other if I have no need for additional workflows?

For example, is there a performance consideration for choosing report or alert?

0 Karma

Esteemed Legend

They are exactly the same thing but one allows you to tack on other things to the end. Just use a report and don't overthink this.

0 Karma

Builder

Thanks woodcock. That was what I wanted to be sure of.

0 Karma