Install and Configure: Reports

The easiest way to adapt or add new reports is to copy an existing report. Go to Other → Reports.

Other -> Reports ” class=”” />
<p>Click <strong>Open in Search</strong> on one of the reports.</p>
<div class= Open in Search

This will bring up a search page with the current reports search populated.

Search bar

Modify the report to obtain the desired result. For instance, to get a report which only displays logs with log level ERROR, click on the field loglevel on the left column and choose ERROR if available, otherwise INFO. The search string will automatically be updated with either loglevel=ERROR or loglevel=INFO.

Field values
Added to search bar

If ERROR was not an available option, update the search string to loglevel=ERROR.

Change to ERROR

The report may not display any error messages if there has not been any error logs, but it will still find any future error logs.

When finished, click Save As menu in the upper right corner, and then click on Report to save the new search as a new report. Fill out the information and click Save.

Save dialogue

Further Help

“Recorded Future App for Splunk” has been developed by Recorded Future.

Further information and support can be found on our Support web site: