Splunk Search

Why is the save button greyed out when attempting to modify a report/search?

infra2sec
Path Finder

Hello,

I am new at this and I have been emailed some search examples to meet an objective. I copied and pasted the search into Splunk and saved it as a report. I'd like to modify the search as I learn. The only option that is available to me is to do a "save as". The save option is greyed out.

Any idea why the save button would be greyed out assuming I have permissions e.g. r/w to my own report?

Thanks!

0 Karma
1 Solution

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

View solution in original post

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

View solution in original post

jcorcoran508
Path Finder

I know its a dated string.  On splunk 8,  when you edit a Report via open search in the report window.   

you will see the "SAVE" button greyed out.   Modify the search string (if that is you intent) , click the search button.

So post change run you see the "SAVE" button be normal , then save the report as the same name.

Or Save as for a new named report using the updated search string.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!