Simple explanation
A report is simply a saved search you can return to and re-run without retyping — the foundation both scheduling and dashboards are built on top of.
Technical explanation
- Any search can be saved as a report — it doesn't need a transforming command or produce a visualization; even a simple filtered raw-event search can be saved for reuse.
- Saving process: Save As > Report, giving it a name and optionally a description, then choosing sharing/permission settings (private, app-level, or global).
- Report permissions — the owner can configure whether a report runs using the OWNER's access/profile or the VIEWER's own access ("Run as" setting), which matters when a report touches data the owner can see but a viewer might not otherwise be permitted to.
- Editing a saved report — the report's name, its underlying search, schedule, and permissions are all editable after creation by someone with appropriate access; note that acceleration settings are configured separately and interact with, but aren't identical to, basic report editing.
- Cloning a report — creating a copy to modify independently, useful when you want a variation without altering the original that others may depend on.
Synonyms / related terms
| Term | Means | |---|---| | Saved search | The underlying concept a report is built on | | Run as | The permission setting controlling whose access level a shared report uses |
Concept Check
"A report shared across the whole team is configured to run using the User role's default access rather than the specific owner's access, and some viewers see fewer results than the owner intended." This is the "Run as" setting working as configured, not a bug — if set to run as the User role rather than the owner's own broader access, viewers only see what THEIR access level (or the generic User role) permits, which may be less than what the owner who built the report can see.
Interview-style Q&A
Q: Why would you deliberately configure a report to 'run as owner' rather than 'run as viewer'? A: "When the report needs to show complete data regardless of who's viewing it — for example, an executive dashboard summarizing security incidents across the whole organization. If it ran as each individual viewer, someone with narrower access might see an incomplete, misleadingly partial picture. Running as the owner (who has the necessary broad access) ensures everyone sees the same, complete report."
Memory trick
"Any Search can become a Report — just Save it" — the simplicity worth remembering: there's no special search syntax required, just the act of saving.