Splunk Search

Why is the save button greyed out when attempting to modify a report/search?

infra2sec
Path Finder

Hello,

I am new at this and I have been emailed some search examples to meet an objective. I copied and pasted the search into Splunk and saved it as a report. I'd like to modify the search as I learn. The only option that is available to me is to do a "save as". The save option is greyed out.

Any idea why the save button would be greyed out assuming I have permissions e.g. r/w to my own report?

Thanks!

0 Karma
1 Solution

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

View solution in original post

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

jcorcoran508
Path Finder

I know its a dated string.  On splunk 8,  when you edit a Report via open search in the report window.   

you will see the "SAVE" button greyed out.   Modify the search string (if that is you intent) , click the search button.

So post change run you see the "SAVE" button be normal , then save the report as the same name.

Or Save as for a new named report using the updated search string.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...