Splunk Search

How to schedule a report without it running

aohls
Contributor

I have a report I want to schedule, the results are populating a dataset. I want to set this to run every Sunday with week averages.
The issue I am having is I want to append the results to the populated table.

I am running my search to populate a few months of data but I want to convert it to run the past 7 days and append to my dataset.
I want to add the outputlookup to my search but then to save it I need to run it; I do not want the data in my dataset right now.
Can I somehow edit the report without needing to run the report and push data into my dataset?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>