Reporting

How do you save reports for long term access?

kbb
Engager

Once reports or saved results are saved, how long are they accessible from the "jobs" page? In the users manual in the "saving reports" section it states "Selecting Get link... automatically saves your report job, which you can access thereafter through the Jobs page". How long is "thereafter"? If you save the results of a report can those be archived elsewhere?

Tags (2)
0 Karma

lguinn2
Legend

Once a search job is saved, it is saved forever. It is possible, though, for the Splunk admin to clean out old search jobs. And anyone who has "write" permissions to the search job can delete it as well.

Splunk doesn't actually save the report - it saves a logical list of the events in the search result. This is part of the "artifacts" of a search job. The artifacts are stored in this directory, and each search job has its own subdirectoy:

$SPLUNK_HOME/var/run/splunk/dispatch

I suppose that you could archive this directory if you wanted to archive your search results. However, it might be easier to export your search results and save that instead...

0 Karma

Jordan_Brough
Path Finder

Is this still true? I just now did a "Save & Share Results" on a search job and when I inspect the job in the job inspector I see a TTL of 1 week. And in the past I have seen search jobs disappear after some time (I assume it was one week).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...