I have some scheduled queries for which the only purpose is to maintain a lookup table (or maybe summary index after I figure out how to do those).
Splunk only allows me to save these scheduled searches as either an alert or a report. Is there any advantage to choosing one over the other if I don't need reporting or alerting on the search?
Thank you lfedak. That explanation notes different workflows that can be built around a saved search. I was wondering if the was any reason to choose one over the other if I have no need for additional workflows?
For example, is there a performance consideration for choosing report or alert?
They are exactly the same thing but one allows you to tack on other things to the end. Just use a
report and don't overthink this.