Save and store results of reports for later use

[horsefez]

Hi fellow splunkers,

my question for today is, if I could somehow save reports for later use.
For example:
I run a report everyday at midnight over the data that got collected yesterday. I want to save the reported data into CSV or PDF.
I want to store the report for at least 10 days so users have 10 days to view it in splunk.
I also want to give users some kind of list, where they then are able to click on a report.

---

Is it possible to save the reported data and store it somewhere for later use?
Is it possible to save a history of reports for a specific time period and let a user choose which report they wanna view?

Best regards,
pyro_wood

[woodcock · Accepted solution]

We used the collect command to save the report details to a Summary Index and then created a macro (you could also create a form) to reconstitute the results. Before sending the data to collect, we added |addinfo|streamstats current=f count as serial to mark each line number and add the info_sid so that the event ordering can be reconstituted and different sets of data (reports) can be discriminated.

[sonila]

can you help with an example of how to do this?

[horsefez]

Amazing, thank you!
Can you add somekind of example search, so I can image this a bit better?

[woodcock]

To get data back just do something like this:

index=MySummaryIndex info_sid=MyReportSid | sort 0 serial | table My List Of Fields And Their Order Here

[horsefez]

Great! This isn't as complex as I thought it is.
Thank you woodcock for your excellent help!