Splunk: Embed scheduled reports

Report embedding lets you bring the results of your reports to large numbers of report stakeholders. With report embedding, you can embed scheduled reports in external (non-Splunk) websites, dashboards, and portals. Embedded reports can display results in the form of event views, tables, charts, maps, single values, or any other visualization type. They use the same formatting as the originating report.

You can't embed a report until it is scheduled to run on a regular interval. An embedded report always displays the results from its last scheduled run. So if an embedded report is set up to run every four hours over the past 24 hours, it will always display results for a previous 24 hour period that were obtained within the last four hours. This design reduces load on your Splunk deployment. This also means that newly embedded reports are blank until their first scheduled run.

Avoid embedding reports that both run on a short schedule and typically take a long time to complete. You cannot view embedded reports until they begin to return results. For example, if you have a report that runs every half hour but takes 25 minutes to return results, the report will be displaying results for just five minutes per half hour. Optimize your search to run faster or schedule the report on a longer interval.

Embedded reports do not have all the features of reports as viewed in Splunk Web. For example, embedded reports do not have drilldown functionality, support for workflow actions, table sorting, or field expansion. When embedded reports display table visualizations, those tables are limited to 10 rows. Embedded reports also cannot support real-time searches.

Your ability to embed scheduled reports is controlled by the embed_report capability. By default this capability is restricted to the Power User role and any role that inherits it, such as the Admin role. A user without this capability cannot enable or disable embedding for a scheduled report.

Once a report is embedded it cannot be edited. You must disable embedding for a report in order to edit it. See "Embed a report," below, for more information.

Embed a report

If you have the capability to embed reports, you will be able to embed any report that you can see on the Reports listing page.

1. Go to the Reports listing page and locate the report that you would like to embed.

Note: Before embedding the report you should run it and adjust its result formatting if necessary. Whatever you define here will dictate how the report will display results after you embed it in an external site. You cannot edit embed-enabled reports.

2. To embed the report, click Edit and select Embed.

If the report is not already scheduled, the Report Must Be Scheduled dialog appears. Click Schedule Report to schedule the report. For more information, see Schedule reports, in this manual.

If the report is already scheduled, Splunk Web opens the Enable Report Embedding dialog. It also opens this dialog when you schedule the report after encountering the Report Must Be Scheduled dialog.

3. In the Enable Report Embedding dialog, click Enable Embedding to embed the report.

The Embed dialog appears with a few lines of code that you can paste into an HTML-based web page.

4. Copy the code out of the Embed dialog and paste it into the HTML-based web page into which you want to embed the report.

5. Click Done to close the Embed dialog.

Note: A newly embedded report will not show data or visualizations until its first scheduled run. So if your report is scheduled to run every hour and you embed the report halfway through an hour, you'll have to wait for approximately 30 minutes before it displays anything.

After you embed a report, you can get its embedding code from the Embed dialog whenever you want. Just go to the Reports listing page, click Edit for the embed-enabled report, and select Embed.

You can embed a single report in multiple web pages. It uses the same display formatting as the originating report wherever it appears.

Disable report embedding

There are two reasons you might want to disable embedding for a report:

• You want to edit the report (update its search string or display formatting). Embedded reports cannot be edited.

  • If you disable embedding for a report, edit it, and then enable embedding for it again, you will have to wait until the report runs on its schedule to see your changes reflected in the external website(s) in which the report is embedded.
• You want to revoke access to the report via the external website(s) in which it is embedded. .

To disable a report, open the Embed dialog for the report and click Disable embedding.