Hello,
I am new at this and I have been emailed some search examples to meet an objective. I copied and pasted the search into Splunk and saved it as a report. I'd like to modify the search as I learn. The only option that is available to me is to do a "save as". The save option is greyed out.
Any idea why the save button would be greyed out assuming I have permissions e.g. r/w to my own report?
Thanks!
Here is what I found after playing around a little bit:
If the report is still running you won't be able to save it.
Also, you have to create a new search and actually search it to save it.
Here is what I found after playing around a little bit:
If the report is still running you won't be able to save it.
Also, you have to create a new search and actually search it to save it.
I know its a dated string. On splunk 8, when you edit a Report via open search in the report window.
you will see the "SAVE" button greyed out. Modify the search string (if that is you intent) , click the search button.
So post change run you see the "SAVE" button be normal , then save the report as the same name.
Or Save as for a new named report using the updated search string.