Creating and Managing Reports

In Splunk, a report is simply a saved search result. When you run a search and see a table, chart, or statistics, that output is only visible to you at that moment. If you close the browser or navigate away, the result is gone. A report is your way of saying, "I want to keep this exact output, give it a name, and be able to see it again later without retyping the whole search."

Reports are stored inside Splunk's Knowledge Objects. A Knowledge Object is just Splunk's term for any piece of saved intelligence — a saved search, an alert, a dashboard panel, a field extraction, or a report. Reports are one of the most useful Knowledge Objects because they turn a one-off investigation into a permanent tool.

When you create a report, you are saving two things: the search query (the instructions for what to look for in the data) and the display format (whether you want a table, bar chart, pie chart, or single value). The actual data is not saved inside the report. Every time you open the report, Splunk re-runs the search against the current data. This is important because it means your report always shows fresh information, not stale numbers from last week.

To create a report, you begin by running any search. Once you see your results, you click the "Save As" button and choose "Report". You then give it a title, a description, and you decide who can see it. You can also choose a time range picker so that whoever opens the report can adjust the time window.

Now, scheduling a report is a separate but related action. Scheduling means telling Splunk to run that report automatically at a specific time, on a specific day, or at a regular interval. For example, you might schedule a report called "Daily Login Errors" to run every day at 8am. When it runs, Splunk will execute the search, generate the output, and then either display the result in the Splunk UI or email it to a list of recipients. Scheduling is perfect for reports you need to check regularly but do not want to remember to run manually.

When you schedule a report, you specify the following:

Reports can also be embedded into dashboards. A dashboard is a collection of panels that show multiple reports side by side. Once a report is saved, you can add it to a dashboard as a panel. This is how operations teams build live monitoring screens that update automatically.

Managing reports involves editing, deleting, sharing, and organising them. You can rename a report, change its search query, adjust its time range, or move it to a different folder (called an "App" in Splunk). You can also set permissions so that only certain users or user roles can view or edit the report.

A key thing to understand is the difference between a Saved Search and a Report. In Splunk, every Report contains a saved search, but not every saved search is a Report. A saved search alone is just the query. A Report is the saved search plus a display format (chart or table). This distinction matters for the exam: if you only save the search, you get a saved search; if you also choose a visualisation, you get a report.

Reports support various output options. You can view them in Splunk Web, export them as CSV or PDF, email them, or even use them to trigger alerts. Alerts are covered in a different exam objective, but on the SPLK-1002 exam, you must know that reports can be scheduled and emailed.

Finally, every report has an owner. The person who creates the report is its owner, and only the owner (or a user with administrative privileges) can delete or modify it. If you leave a company, the report does not disappear — it gets reassigned to another user or becomes orphaned until an admin cleans it up.

An IT professional working in a service desk manages a Splunk environment that collects logs from the company's employee VPN. Every morning, the manager asks, "How many people connected to the VPN yesterday?" The IT support person could run the same search every day. It would work, but it is boring and error-prone. Instead, they create a report called "Daily VPN Connections." They write the search to count unique usernames connected to the VPN service in the last 24 hours, display it as a single number on a gauge, and save it.

But the IT person does not stop there. They schedule this report to run every weekday at 7:45am, fifteen minutes before the manager's daily stand-up meeting. The report is configured to email the result as a PDF attachment to the manager, the IT team lead, and the security analyst. Every morning at 7:45, the report runs automatically, generates a PDF showing yesterday's connection count, and lands in the manager's inbox without anyone having to remember to run a search.

Later, the same IT person needs to track which departments use the VPN most heavily. They create a second report called "VPN Usage by Department." This time they use a bar chart showing connections grouped by department field. They make this report editable by the whole IT team but viewable only by managers. They add it to a dashboard called "Network Security Dashboard" so that the security team can glance at it alongside other metrics.

When a new employee joins the IT team, they do not need to learn how to write a search for VPN counts. They just open the existing report and see the latest numbers, or they can look at status in the dashboard. The report saves training time and ensures consistency — everyone sees the same query, the same format, and the same results.

Real-world tasks include:

This workflow replaces the old way of doing things, which was manually checking logs, writing down numbers, and emailing screenshots. Reports automate that entire process and make the data accessible to non-technical stakeholders without giving them direct access to raw log data.