Splunk Search

Why is the save button greyed out when attempting to modify a report/search?

infra2sec
Path Finder

Hello,

I am new at this and I have been emailed some search examples to meet an objective. I copied and pasted the search into Splunk and saved it as a report. I'd like to modify the search as I learn. The only option that is available to me is to do a "save as". The save option is greyed out.

Any idea why the save button would be greyed out assuming I have permissions e.g. r/w to my own report?

Thanks!

0 Karma
1 Solution

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

View solution in original post

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

jcorcoran508
Path Finder

I know its a dated string.  On splunk 8,  when you edit a Report via open search in the report window.   

you will see the "SAVE" button greyed out.   Modify the search string (if that is you intent) , click the search button.

So post change run you see the "SAVE" button be normal , then save the report as the same name.

Or Save as for a new named report using the updated search string.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...