From the course: Practical Splunk: Build Data Intelligence through SPL, Reports, and Dashboards
Join today to access over 25,500 courses taught by industry experts.
Saving and scheduling reports - Splunk Tutorial
From the course: Practical Splunk: Build Data Intelligence through SPL, Reports, and Dashboards
Saving and scheduling reports
- Welcome back. In this lesson, we are going to look at saving and scheduling reports. Scheduling is something you will do very often in Splunk. Let's dive in. There are a few things you need to pay attention to when you are saving a report. Pay attention to the search mode. If you recall, you can create a report by running an ad hoc search and then saving it as a report. The search mode that you use when running the ad hoc search will be preserved. For instance, if you run the search in verbose mode and save it as a report, the report will run in verbose mode when you run the report. You want to avoid verbose mode because it is very resource intensive and in most cases, you are only interested in statistics of the search results and verbose mode is not required in that case. The search mode that you use, as I mentioned, will be preserved in the report, and another suggestion I have is use a naming convention for your reports, and this holds good for any knowledge object that you…
Download courses and learn on the go
Watch courses on your mobile device without an internet connection. Download courses using your iOS or Android LinkedIn Learning app.