Splunk Search

Main differences between a saved report and a saved search

e82than
Communicator

I wonder if there is any site in splunk Docs that clearly define the distinct differences between the two of them. I am having trouble deciding which one to use.

Tags (1)

BobM
Builder

I would add that in version 5, unless you are in verbose mode, a report will not create fields that it does not require. This can mean your results arrive a little faster.

I think what is more important is how you want to look at your data. If you want a table or graph of information summarised from your events, you should use reporting commands. If you want the original events, don't.

lguinn2
Legend

There is no practical difference between a saved search and a saved report. A report is simply a search that incorporates one of the "reporting commands" such as stats, chart, timechart, etc.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...