Main differences between a saved report and a saved search

[e82than]

I wonder if there is any site in splunk Docs that clearly define the distinct differences between the two of them. I am having trouble deciding which one to use.

[BobM]

I would add that in version 5, unless you are in verbose mode, a report will not create fields that it does not require. This can mean your results arrive a little faster.

I think what is more important is how you want to look at your data. If you want a table or graph of information summarised from your events, you should use reporting commands. If you want the original events, don't.

[lguinn2]

There is no practical difference between a saved search and a saved report. A report is simply a search that incorporates one of the "reporting commands" such as stats, chart, timechart, etc.