Sharing reports not as simple as documented?

[wuming79]

Reference: https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Search/SavingandsharingjobsinSplunkWeb

I copied the link and sent it via email to another PC, but when I click on the link, it will say "Unknown sid. The search job 'unknown' was canceled remotely or expired"

Is there a quicker way to share my report or search syntax to a third party?

[DalJeanis]

You have two potential issues.

First, if you are running an adhoc search, the search will go away as soon as you stop looking at it, unless you have saved it.

1) Run the search
2) send to background (after it completes this will save it for a week usually). Have it email you when the search is done.
3) verify the link in the email goes to the search.

Second, the third party has to have security access to the search. If you can see the saved search and they can't, then you'll have to check that. If you can't get around the security issues, then consider sending the results as PDF or CSV. (Always assuming that you are not sending confidential data without following your organization's guidelines regarding methods, authorization, and so on.)