Create a report using an SPL2 search

Save an SPL2 search as a report so that you can run the search again without having to re-enter it, share it with other users, and use it to support other knowledge objects.

A report is a saved copy of your search that you can open and run without having to re-enter the search into the Search & Reporting app. When you create a search that you would like to run again at a later point in time or share with other users in the Splunk platform deployment, you can save that search as a report. Reports are available on the Reports page in the Search & Reporting app.

You can use reports to support other knowledge objects in your Splunk platform deployment. For example, you can schedule a report to run on a regular interval to trigger alert actions, and you can use a report as a dashboard panel.

For complete information about reports, see the following documentation:

Splunk Cloud Platform

See the Reporting Manual in the Splunk Cloud Platform documentation.

Splunk Enterprise

See the Reporting Manual in the Splunk Enterprise documentation.

The exact workflow for creating a report from an SPL2 search varies depending on whether you are working with searches in the Search bar or the SPL2 module editor. For detailed instructions, see the following sections on this page:

Save a search as a report from the Search bar

After running a search, you can save the search as a report.

On the Search page of the Search & Reporting app, after running a search, you can use the Save As menu located above the Search bar to save your search as a report.

This image shows the Search bar after a search has been run. The "Save As" menu is highlighted by a red box.
  1. On the Search page of the Search & Reporting app, set the language picker to SPL2. Then, enter an SPL2 search in the Search bar and select the Search icon (This image shows an icon with a magnifying glass.) to run it.

    For more information about navigating to and using the Search bar, see Search page overview for SPL2 and Run an SPL2 search in the Search bar.

  2. Select Save As, then Report.
  3. Configure your report using the options in the Save As Report dialog box:
    1. In the Title field, enter a unique name for the report.
    2. (Optional) In the Description field, enter a description for the report.
    3. Set the Time Range Picker toggle switch to choose whether to include a time range picker in the report.

      A time range picker allows users without write permissions to rerun the report over a different time range without actually editing it. Be aware of the following:

      • If you do not provide a time range picker, the report always runs over the same time range as the original search. To change the time range, a user with write permissions for the report must open it in Search, update its time range, and then save that edit.

      • The time range picker option is unavailable for scheduled reports, which always display the results returned by their last scheduled run. If you schedule a report that has a time range picker, the time range picker disappears.

  4. Select Save.

The Search & Reporting app returns a message confirming that your report has been successfully created, and displays options for next steps that you can take with your report, such as sharing your report with others by changing its permissions or scheduling the report to run on a regular interval.

To see a list of all your reports, navigate to the Reports page of the Search & Reporting app.

This image shows the navigation bar of the Search & Reporting app with the Reports page highlighted.

Save a search as a report from the SPL2 module editor

After running a search, you can save a search as a report from the SPL2 module editor.

The following instructions assume that you have already created an SPL2 module containing the search that you want to save as a report. For detailed information on how to navigate to the SPL2 module editor and create a module, see SPL2 module editor overview and Create an SPL2 module.

In the SPL2 module editor, after writing a search, you can use the options in the Outline panel to export the search and then save it as a report.

This image shows the SPL2 module editor after a search has been exported and the module has been saved. The options menu in the Outline panel is highlighted by a red box.
  1. Open your SPL2 module for editing in the SPL2 module editor.
  2. In the Outline panel, select the Options icon (This image shows an icon with 3 dots in a vertical orientation.) beside the name of the search that you want to save as a report, and then select Export.
  3. Select Save to save your changes to the module.
  4. In the Outline panel, select the Options icon (This image shows an icon with 3 dots in a vertical orientation.) beside the name of the search, and then select Use in report.
  5. Configure your report using the options in the Save As Report dialog box:
    1. In the Title field, enter a unique name for the report.
    2. (Optional) In the Description field, enter a description for the report.
    3. Set the Time Range Picker toggle switch to choose whether to include a time range picker in the report.

      A time range picker allows users without write permissions to rerun the report over a different time range without actually editing it. Be aware of the following:

      • If you do not provide a time range picker, the report always runs over the same time range as the original search. To change the time range, a user with write permissions for the report must open it in Search, update its time range, and then save that edit.

      • The time range picker option is unavailable for scheduled reports, which always display the results returned by their last scheduled run. If you schedule a report that has a time range picker, the time range picker disappears.

  6. Select Save.

The SPL2 module editor returns a message confirming that your report has been successfully created, and displays options for next steps that you can take with your report, such as sharing your report with others by changing its permissions or scheduling the report to run on a regular interval.

To see a list of all your reports, navigate to the Reports page of the Search & Reporting app.

This image shows the navigation bar of the Search & Reporting app with the Reports page highlighted.

See also

For more information about working with reports:

Splunk Cloud Platform

See the Reporting Manual in the Splunk Cloud Platform documentation.

Splunk Enterprise

See the Reporting Manual in the Splunk Enterprise documentation.