VMware ESXi and vSphere Cluster Management

Launch the Search & Reporting App in Splunk

Learn how to open Splunk's Search & Reporting app, understand its landing view, choose a time range, and run an initial search against indexed events.

What the Search & Reporting app does

The Search & Reporting app is Splunk's primary workspace for searching and investigating indexed events. It also provides tools for creating reports, managing alerts, and viewing or building dashboards.

Indexed events are time-stamped machine data that Splunk has ingested and made available for searching. Data must already be available in the Splunk deployment before a useful search can return results. Launching the app is therefore the first step before entering search syntax or analyzing events.

Open Search & Reporting

Start at the Splunk home page or open the app selection area.
Locate the app entry or icon labeled Search & Reporting.
Select the app.
Confirm that its search-oriented landing or summary view opens. A search input and a time range selector should be available in or near the main workspace.

The exact layout can vary slightly between Splunk versions. Panels and labels may also differ because of user permissions, installed apps, or interface customization.

Understand the landing view

The initial view is an overview of search-related navigation and activity. Depending on the deployment, it can show links to learning resources, a summary of data available to you, and searches from your history. Use it to orient yourself before starting an investigation.

Main elements of the Search & Reporting landing view

Interface element	Purpose	Typical user action
App navigation bar	Moves among search and analysis capabilities.	Choose Search, Pivot, Reports, Alerts, or Dashboards.
Search bar	Accepts a search string for finding or analyzing indexed events.	Enter a simple search or a dataset restriction.
Time range picker	Defines the earliest and latest event times included in a search.	Choose a window that covers when the expected data was ingested.
Search help resources	Provides introductory learning material and detailed search-reference documentation.	Open a tutorial for a guided introduction or reference documentation for syntax details.
Available-data summary	May summarize data that the current user can access.	Use the summary to identify a suitable dataset or index for later searches.
Search history	Provides access to searches previously executed by the user.	Reopen, review, or refine an earlier search.

Use the app navigation bar

The app-level navigation bar provides access to different ways of working with Splunk data. Not every deployment presents every destination identically, but these are common destinations.

Destination	Primary use	When a beginner would use it
Search	Runs and examines ad hoc searches.	Use it when exploring events or testing a search idea.
Pivot	Provides guided analysis that can create searches from data models or structured fields.	Use it when you want a visual or guided way to analyze prepared data.
Reports	Stores saved searches and reusable reporting outputs.	Use it to run or review a search that has been saved for repeated use.
Alerts	Manages saved search conditions that can trigger notifications or actions.	Use it to review or configure searches that monitor for specified conditions.
Dashboards	Displays or creates collections of visual panels based on search results.	Use it to monitor information or present results in a consolidated view.

Identify the search bar

The search bar is the field where you enter a search string. A search string is text that tells Splunk what events to find or how to analyze them.

Later searches can be refined with search terms, fields, commands, and filters. This lesson focuses on reaching the workspace and submitting an initial search; detailed Search Processing Language (SPL) instruction belongs in subsequent lessons.

Choose a time range

The time range picker controls which event times Splunk includes in the search. Choose an appropriate time window before submitting the search, such as the period when the source data was ingested.

Time selection affects both search speed and whether expected events appear. A very broad range can require more processing, while a range that is too narrow can exclude the events you expect to find.

Run an initial search

Choose a time range that includes the period when the data was ingested.
Enter a simple search string or a dataset restriction appropriate to the data available to you.
Confirm the selected time range.
Submit the search by pressing Enter or selecting the search, often shown as a spyglass, control.
Wait for Splunk to execute the search and display the results page.

No command-line configuration is required for this step. You enter the search string in the Search & Reporting interface and use the time range picker and submit control.

Example sequence: choose time range → enter search string → press Enter or select the spyglass

Use search help resources

A search assistance panel commonly includes built-in learning or documentation links. Introductory tutorial material is intended to guide new users through basic searching and investigation. Detailed search-reference documentation is useful when you need the syntax, behavior, or options for a particular search feature.

Use the tutorial when you need a structured introduction. Use the reference documentation when you already know what you want to do and need precise syntax guidance.

Check available data

The landing view may summarize data available to the current user. This visibility depends on which data has been indexed, the user's assigned roles, and index permissions. A summary is not necessarily a complete inventory of everything in the deployment.

Use the available-data view as a starting point for selecting an appropriate dataset or index in later searches. If expected data is missing from the summary, validate access and indexing rather than assuming that the search syntax is incorrect.

Reuse searches with search history

Search history is a record of searches previously executed by a user. It can help you reopen a known search, review how an earlier investigation was performed, and refine that search instead of entering it again.

History availability depends on the current user context, retention behavior, and interface version. A search run by another user may not appear in your history. Saved reports or shared knowledge objects are more appropriate when a search must be reused across users.

Practical example: open the search workspace

Start from the Splunk home page or app selection area.
Select Search & Reporting.
Confirm that the landing view opens.
Locate the search input and time selector.
Briefly identify the navigation bar, help resources, available-data summary, and search history if those panels are shown.

After these steps, you can reach the interface used to search indexed events.

Practical example: prepare and submit a search

Choose a time range covering the expected ingestion period.
Enter a simple search term or dataset restriction appropriate to your available data.
Submit the search with Enter or the search icon.
Review the resulting search page before adding more search language.

This sequence establishes the basic workflow: select time, enter a query, execute it, and inspect the results.

Practical example: reuse earlier work

Locate the search history area on the landing view or search interface.
Select a previous search if one is available.
Review or edit it as the starting point for another investigation.

Troubleshooting

Search & Reporting is not visible

Possible causes include an app that is not installed or enabled, a role without access, or a filtered or customized app launcher.

Check the available app list and any app-filtering controls.
Ask a Splunk administrator to verify your role permissions.
Confirm that the Search & Reporting app is installed and enabled.

A search returns no events

Common causes include a time range that excludes the event timestamps, data that has not been indexed, an overly restrictive search string, or missing permission to search the relevant index.

Expand the time range to cover the expected ingestion period.
Verify that the data was added and indexed successfully.
Try a simpler search before adding filters.
Confirm index access and search permissions.

Expected data is missing from the available-data summary

The data may not have been ingested or indexed, the associated index may not be visible to your role, or the summary may not yet reflect recent changes.

Verify ingestion and index assignment.
Review your role and index permissions.
Run an appropriately scoped search to test whether the events are searchable.

Search history is empty

You may not have executed a search in the current user context, the search may have been run by another user, or history behavior may differ because of deployment settings or interface version.

Run a new search and return to the history area.
Verify that you are using the expected user account.
Use saved reports or shared knowledge objects when searches must be reused across users.

Key points

Search & Reporting is the main Splunk app for ad hoc searching and investigation of indexed events.
Data must be ingested, indexed, and permitted for your role before searches can return useful results.
Open the app from the Splunk home page or app launcher by selecting its Search & Reporting entry or icon.
Before submitting a search, enter a search string and choose a time range that includes the expected events.
Press Enter or select the search/spyglass control to run the search.
Use Search, Pivot, Reports, Alerts, and Dashboards according to the type of analysis or presentation you need.
Help resources, available-data summaries, and search history can make the first investigation easier.

Continue with the Search & Reporting app launch lesson when you need to review this workspace before learning SPL fundamentals.