Install and Configure: Reports

The easiest way to adapt or add new reports is to copy an existing report. Go to Other → Reports.

This will bring up a search page with the current reports search populated.

Modify the report to obtain the desired result. For instance, to get a report which only displays logs with log level ERROR, click on the field loglevel on the left column and choose ERROR if available, otherwise INFO. The search string will automatically be updated with either loglevel=ERROR or loglevel=INFO.

If ERROR was not an available option, update the search string to loglevel=ERROR.

The report may not display any error messages if there has not been any error logs, but it will still find any future error logs.

When finished, click Save As menu in the upper right corner, and then click on Report to save the new search as a new report. Fill out the information and click Save.

Further Help

“Recorded Future App for Splunk” has been developed by Recorded Future.

Further information and support can be found on our Support web site: support.recordedfuture.com