Hello! I'm Chris with Splunk Education. In this module, we'll look at how to use scheduled reports and alerts to better automate processes in your deployment. We'll begin with scheduled reports. A scheduled report is a report that runs on a scheduled interval. Every time a scheduled report is run, it can automatically be sent by email or trigger additional actions. They can also be used to power dashboard panels to prevent Splunk from running multiple concurrent ad hoc searches. Meet Dan, a sales employee from the fictional gaming company, Buttercup Games. Every Monday, he needs to report on the previous week's product sales numbers, in order to monitor the progress his team is making with the new sales strategy. Rather than run this report manually every time, he would like to set it up to run automatically. A scheduled report is the perfect solution for Dan's reporting needs. To create our scheduled report, we first start with the search we want the report to be based on. From the Save As menu, select Report. Give the report a name. We also have the option of adding a Time Range Picker to the report. Since this report will be scheduled, there is no reason to include the picker. After we create our report, we select the Schedule option from the additional settings links. The Edit Schedule window now opens. Select "Schedule Report" and the frequency to run the report. For our sales report, Dan needs it to run every week on Monday, at 6 a.m. Then we select the time range that the report will cover. Typically the time range is relative to the schedule. Since we need to run the report every week, we set our time range to return events from over the last seven days. Running concurrent reports, and the searches behind them, can put a demand on your system hardware, even if everything is configured to the recommended specs. Splunk has settings that allow us to set schedule priority for scheduled searches and set a time window that they may run in. These help us manage our scheduled reports so that they put less strain on our deployment. Schedule priority is only available to admin users, and allows us to choose between default, higher, and highest. Giving a scheduled report a greater priority will make sure that they take priority over other searches being run on the system at that time. The Schedule Window settings will allow us to set a time frame in which to run our report. So, if we have other reports scheduled to run at the same time, we can provide a window in which to run a report. This provides some timing flexibility as to when the report is actually executed. If the system is busy, our report will be delayed as long as it falls within our acceptable window. You would include a Schedule Window only if the report doesn't have to start at a specific time, and you're okay with the delay. Setting the window to "Auto" will allow Splunk to automatically determine the best time window in which to run the report. Next, we can choose what actions to trigger when a scheduled report is run. There are options for logging an event to a Splunk receiver endpoint, outputting results to a lookup, sending results to a telemetry endpoint, running a script, sending an email, and posting to an external URL. Splunk also lets you install, or build, custom alert actions depending on your user role. Admin users will have the option to manage and add prebuilt alert actions by selecting "Manage Actions". We have added a link in your notes to courses and documentation on building your own actions. Dan would like to receive this report via email, so we will add that trigger action to the report. We select "Send email". This is configured by entering one or more addresses in the "To" field, separated by a comma. We set the priority, and can customize the subject and message sent in the email by using tokens. Here we are supplying the name of the report, but there are many tokens that can be used. I have added a link in the notes to documentation on the available tokens. There are options of what to include in the email. These include links to the report and results, search string run, and documents to attach. We have the option to send the email in HTML and/or plain text format. Clicking Save, our report is scheduled and Dan will start getting his report first thing every Monday morning.
