This chapter starts with creating reports from a search, which is the foundation for creating dashboards and alerts as well. When you have created and executed a search using SPL, inspected the results to ensure they include all the data you wanted them to, and selected and configured the visualization options so that the output is meaningful and useful, you have several options for saving the search and search results so they can be shared and viewed by others, and/or run again on an ad-hoc or scheduled basis to support a business function.
The choices for accomplishing this are available by clicking the Save As... link to the top-right of Splunk Web and selecting the desired option from the following list:
- Report
- Dashboard panel
- Alert
- Event type
We'll cover each of these options in turn, and, in the process, leverage a useful search that provides an assortment...
