Edit Splunk Report

In this section, we are going to learn about how the Report is generated in the Splunk. It can also be used further to save it for the local use, or we can also set it up to a custom dashboard. We will look forward to changing its permission and how we can edit a report in Splunk after it has been saved. We will also learn to change the view permission of the Reports generated.

Edit a report

We can edit a current report quite quickly. We can modify the report (its search string, pivot setup, or formatting of the result). We can also edit its settings for description, permissions, schedule, and acceleration.

To edit a report's definition

If we want to edit a report's definition, there are two ways to start, depending on whether we're on the Reports listing page or looking at the report itself.

• If we're on the Reports listing page, locate the report we want to edit, go to the Actions column, and click Open in Search or Open in Pivot (we'll see one or the other depending on which tool we used to create the report).
• If we've entered the report to review its results, click Edit and select Open in Search or Open in Pivot (we'll see one or the other depending on which tool we used to create the report).

Edit, the definition of a report, opened in Search

We can change the search string, the time range, or report formatting after opening a report in Search. A Save button will be activated towards the report's upper right after we re-run the test. To save the Article, click this. There is also the option to save our edited Search as a new report.

Edit, the definition of a report, opened in Pivot

After opening a report in Pivot, change the pivot definition as we wish. We can add, delete or redefine filters, split rows, split columns, or values for columns. We may also change the formatting of the pivot results (change the type of visualization, or correct how a map displays). When we're done, press Save to save our report at the top-right of the page. We've also the option to save our edited pivot as a new report.

After opening a report in Pivot, change the pivot definition as we wish. We can add, delete or redefine filters, split rows, split columns, or values for columns. We may also change the formatting of the pivot results (change the type of visualization, or correct how a map displays). When we're done, press Save to save our report at the top-right of the page. We've also the option to save our edited pivot as a new report.

We can do this from the Reports listing page, or the report is viewing page. Click Edit and choose:

• Edit Description to change the name and description of the report.
• Edit Permissions to change the report permissions.
• Edit Schedule to schedule the report or change the report schedule if it already has one.
• Edit Acceleration to change the way the report is accelerated.

Note: This option is only available for certain kinds of reports created in Search. We can't perform these actions if we've opened the report in Search or Pivot. If we want to edit these aspects of the report, save the report or return to the Reports listing page.

Use the Advanced Edit page to update a report configuration

If our function requires this, the Advanced Edit page will edit the complete configuration of a text. The Advanced Edit tab provides a wide variety of settings for report configurations.

The Advanced Edit page does not include a list of settings choices nor validates the values we include. To learn more about the settings and how they should be filled out, check savedsearches.conf.spec before changing settings on this page.

Prerequisites

• Admin role, power role, or another role with the schedule_search capability.
• See savedsearches.conf.spec file for documentation of all of the settings on the Advanced Edit page.

Steps

1. Select Settings > Searches, Reports, and Alerts.
2. Find a report that we want to edit and select Edit > Advanced Edit.
3. Update the report configuration as necessary.
4. Save our changes.

Clone a report

Cloning reports are a way to build a report based on an existing report quickly. We can then assign a unique name to the clone and edit it so that specific results are returned.

Note: If we opened the report in Search or Pivot, we could not perform this action. If we wish to duplicate it, save the report or return to the Reports listing tab.

Caution: Do not put the same name and search string on our cloned report as the original report. When we do so, we establish a situation where both the original report and the cloned report are related. This means that for its copy to exist, the initial report has to live. When the original report is deleted, the associated clone report disappears with it.

To take advantage of this connection, if we keep our clone private, we could give it the same name as its source text. When a user updates the original Article, Splunk software also updates the personalized private clone linked to it.

1. Open the Reports listing page.
2. Locate a report that we want to clone and click its Edit link.
3. From the list that appears, select Clone.
4. For New Title, provide a unique name for the cloned report.
   Splunk software gives the cloned report the name of the original report plus the word "clone." Particularly if we intend to share it with other users, we suggest that we give the cloned report a unique name.
5. Give the cloned report a Description and set its Permissions. It is optional.
   If we do not wish to share the cloned report with anyone, leave the permissions set to Private. If we want the cloned report to have the same permissions as its original report, select Clone.
6. To clone the report, click Report Clone. The cloned report now appears on the listing page for the Results.

Disable a report

We can disable a report if our permissions allow it. If a report is disabled, it will continue to appear on the Report listing page and in Searches, Notifications, and Warnings, but it can not be executed.

This function is usually used to disable the scheduled files. This means they stop running on their schedule, but with their schedule definitions intact, they still exist in the system. We can activate a scheduled report that is disabled when we want it to run again on its schedule.

1. Navigate to Settings > Searches, Reports, and Alerts.
2. Locate the Search we want to disable and click its Disable link.

If we are attempting to run a report that is disabled, we will see an error message. If our permissions allow this, the message will include an Enable Report button that we can use to enable the disabled report and an Open in Search button that we can use to execute the report's search string.

Delete a report

We may remove a report from either the Reports list page or the Document display page. Just click Edit, and choose Delete. Many of the roles can only remove reports they made. For more information on allowing roles to delete reports, they do not own,

Note: If we opened the report in Search or Pivot, we could not perform this operation. If we want to edit certain parts of the report, save the report or return to the Reports listing tab.