How to Create and Manage a Report in Splunk

Learn how to save a Splunk search as a reusable report, configure content and time settings, share it, schedule it, add it to dashboards, and manage it later.

A Splunk report is a saved search intended for repeated use or sharing. Instead of rebuilding an ad hoc search each time, you save its search definition and selected presentation settings so users can run and consume it later.

A report is a type of saved search. The saved search contains the search definition, while the report can also preserve associated output settings, such as a table or visualization. Reports can be used independently, placed on dashboards, shared with other users, scheduled, or accelerated when eligible.

Report creation lifecycle

Open the Search app and create a search.
Run and validate the search.
Use Save As and choose Report.
Configure the report title, description, content, and time behavior.
Save the report.
Separately configure permissions, dashboard placement, scheduling, or acceleration as needed.
Later, manage the report from Settings and Searches, reports, and alerts.

Prerequisite: create and run a search

Start in the Splunk Search app. Enter a search and select the control that runs it. Validate the search before saving it: check that the time range is appropriate, the events or summaries are correct, and the result format matches the report's purpose.

A simple event search returns matching events. A transforming search changes events into summarized output, such as a statistics table or chart-ready result. Transforming searches are especially useful for reports because their output can be saved as a table, a visualization, or both.

index=security action=failure
| stats count by user, src_ip
| sort - count

This example summarizes failed authentication activity by user and source IP. If the results show the expected columns and values, the search is a suitable candidate for a reusable security activity report. Learn more about the stats command and sort command.

Save a search as a report

Complete and run the search in the Search app.
From the search results, select Save As.
Select Report.
Complete the Save As Report dialog.
Save the report and confirm that Splunk creates it.

The Save As Report dialog is where you define the report's identity and display behavior. Saving the report stores the search for later reuse; it does not automatically perform every operational task associated with the report. Sharing, dashboard placement, scheduling, and acceleration are separate configuration steps.

Configure report identity

Title

Enter a descriptive title. A good title tells users what the report measures and, when useful, which audience or system it concerns. For example, Failed Authentication Activity by User is more useful than Search 1.

Description

Add an optional description explaining the report's purpose, expected output, data scope, or intended audience. Descriptions help users distinguish similar reports when they browse saved objects later.

Choose report content

Report content is the output presentation retained by the report. For a transforming search, the available choices commonly include a table, a visualization, or both, depending on the output produced and the Splunk interface version.

Choose the content according to how people will consume the report:

Table: Use when analysts need exact rows, counts, fields, or values to inspect and compare.
Visualization: Use when trends, proportions, rankings, or other visual patterns are the main purpose. This is often appropriate for a dashboard panel.
Both: Use when viewers need a chart for quick interpretation and a table for detailed inspection.

If a report later displays an unexpected table or chart, edit its settings and verify that the intended content option was selected.

Configure the Time Range Picker

The Time Range Picker is a report control that lets a viewer choose the time window over which the report runs.

Enabled: Viewers can select the report's time range, such as recent hours, days, or another available period. This is useful for interactive analysis and reports used by different people at different times.
Disabled: The report runs with its saved time range. This creates a fixed time range, which is useful when the report must consistently cover a defined period or when viewers should not change the scope.

Enable the picker for a flexible operational or investigative report. Disable it when consistency is more important than interaction, such as a report intended to represent a specific saved reporting period. For related concepts, see the Time Range Picker guide.

Save As Report settings

Setting: Title
Purpose: Identifies the report in lists, dashboards, and search results.
Choices or behavior: Enter a descriptive name.
When to use it: Always use a specific name that distinguishes the report from similar saved searches.

Setting: Description
Purpose: Explains the report's purpose and expected output.
Choices or behavior: Optional text describing scope, audience, or interpretation.
When to use it: Add one when other users will browse, share, or maintain the report.

Setting: Content
Purpose: Determines which saved output presentation viewers receive.
Choices or behavior: Table, visualization, or both when those output types are available.
When to use it: Select table for detailed values, visualization for patterns, or both for combined analysis.

Setting: Time Range Picker
Purpose: Controls whether viewers can choose the report time window.
Choices or behavior: Enabled for viewer-selected time ranges; disabled for the saved fixed time range.
When to use it: Enable it for interactive use and disable it for consistent, fixed-period reporting.

Actions after creating a report

After saving, review the available actions for the new report. The exact controls can depend on your Splunk version and permissions.

Action: Configure permissions
Purpose: Controls who can view or use the report.
Typical use case: Share a security report with analysts or make an operational report available to a broader role.

Action: Add to a dashboard
Purpose: Places the report or its visualization on a dashboard.
Typical use case: Create a monitoring page that combines several report panels.

Action: Schedule the report
Purpose: Runs the report automatically at defined intervals.
Typical use case: Support recurring operational review or scheduled reporting.

Action: Accelerate the report
Purpose: Applies a performance-oriented setting intended to make eligible results available more quickly.
Typical use case: Improve response time for a frequently used, eligible report after considering resource usage.

Action: Edit from Searches, reports, and alerts
Purpose: Changes the saved report's definition or settings later.
Typical use case: Update the title, content selection, time behavior, or other report properties as requirements change.

Permissions and sharing

Permissions are access settings that control who can view or use a report. Configure permissions for the intended users or roles rather than assuming that saving a report makes it available to everyone. For a focused walkthrough, see Share a Report.

Dashboard placement

A dashboard is a Splunk page that can contain reports and visualizations for monitoring or analysis. Add a report to a relevant dashboard when users need it as part of a larger operational view.

Scheduling

A schedule runs a report automatically at defined intervals. Scheduling is separate from saving the report. Before scheduling, confirm the time range, permissions, expected runtime, and intended recipients or consumers.

Report acceleration

Report acceleration is a performance-oriented setting for eligible reports. It can make report results available more quickly, but it should be enabled deliberately because accelerated reporting can consume additional system resources. Confirm that the search and environment support acceleration before relying on it.

Find and edit an existing report

Open Settings in Splunk Web.
Select Searches, reports, and alerts.
Locate the saved report in the list. Use its title, owner, app context, or other available filters to distinguish it from similar objects.
Open the report's management or edit action.
Update the required settings and save the changes.

The Searches, reports, and alerts page is the management area for locating saved searches, reports, and alerts. If a report was saved successfully but is not visible, check the selected app context and whether your role has permission to view or edit it.

Practical examples

Reusable security activity report

Run a transforming search that summarizes failed authentication activity. Save it as Failed Authentication Activity by User, add a description for security analysts, and retain the results table. Configure permissions for the analyst role and optionally place the report on a security dashboard.

Visualization-focused operational report

Run a transforming search that produces a chart showing activity over time. Save the report with visualization content so it can be used as a dashboard panel. Keep a table as well if viewers need to inspect the underlying summarized values.

Flexible interactive report

Enable the Time Range Picker when users need to review the same search across recent hours, days, or other selected periods. This lets each viewer choose the reporting window without creating separate reports.

Fixed-period report

Disable the Time Range Picker when the report must consistently run over its saved time window. Review the saved time settings carefully so the fixed period matches the reporting requirement.

Troubleshooting

The report is difficult to find

Likely cause: The title or description is vague. Resolution: Use a specific title and add a description that identifies the purpose, audience, and expected output.

The report does not show the expected table or chart

Likely cause: The wrong content option was selected when saving the transforming search. Resolution: Edit the report and verify whether table output, visualization output, or both should be retained.

Users cannot adjust the reporting period

Likely cause: The report was saved without a Time Range Picker. Resolution: Edit the report and enable the picker if viewers need to choose their own time windows.

The report always runs over an unexpected fixed period

Likely cause: The report has no Time Range Picker and uses its saved time range. Resolution: Review the saved time settings or enable the picker when interactive time selection is required.

Other users cannot access the report

Likely cause: Permissions were not configured for the intended audience. Resolution: Review the report permissions and share it with the appropriate users or roles.

The report needs changes later

Likely cause: You are looking only at Search app results instead of the saved-object management area. Resolution: Go to Settings, open Searches, reports, and alerts, locate the report, and edit it there.

Exam-relevant notes

A report is a saved search intended for reuse or sharing.
Save a report from completed search results by selecting Save As, then Report.
The Save As Report dialog configures identity, content, and time behavior.
A transforming search can provide table output, visualization output, or both for report content.
Enabling the Time Range Picker lets viewers choose the report time range; disabling it uses the saved fixed time range.
Permissions, dashboard placement, scheduling, and acceleration are separate post-creation configurations.
Manage an existing report through Settings > Searches, reports, and alerts.

For a broader introduction, review Reports Overview. Related subjects include Alerts Overview and creating an alert.