Splunk Search

Why is the save button greyed out when attempting to modify a report/search?

infra2sec
Path Finder

Hello,

I am new at this and I have been emailed some search examples to meet an objective. I copied and pasted the search into Splunk and saved it as a report. I'd like to modify the search as I learn. The only option that is available to me is to do a "save as". The save option is greyed out.

Any idea why the save button would be greyed out assuming I have permissions e.g. r/w to my own report?

Thanks!

0 Karma
1 Solution

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

View solution in original post

infra2sec
Path Finder

Here is what I found after playing around a little bit:

If the report is still running you won't be able to save it.

Also, you have to create a new search and actually search it to save it.

jcorcoran508
Path Finder

I know its a dated string.  On splunk 8,  when you edit a Report via open search in the report window.   

you will see the "SAVE" button greyed out.   Modify the search string (if that is you intent) , click the search button.

So post change run you see the "SAVE" button be normal , then save the report as the same name.

Or Save as for a new named report using the updated search string.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...