Simple explanation
A scheduled report runs automatically on a defined interval, rather than requiring someone to manually re-run it — this lesson covers how that works.
Technical explanation
- Scheduling a report: after saving a report, the Schedule option lets you configure a recurring interval (hourly, daily, weekly, custom cron-style scheduling for more precise control).
- Scheduled report primary use — commonly used to trigger an ALERT when conditions are met, or simply to keep a report's results continuously current without manual intervention (e.g., generating and emailing a daily summary automatically).
- Time range interaction with scheduling — a scheduled report's search still uses whatever relative time range is configured in the search itself (like
earliest=-24h), which is what makes the same scheduled search produce fresh, relevant results each time it runs, rather than always returning the exact same historical window. - Auto-generated PDF delivery — scheduled reports can be configured to automatically generate and email a PDF of results/visualizations to specified recipients on each run, a common way to distribute recurring status information without requiring recipients to log into Splunk directly.
- Concurrent execution considerations — scheduling many reports at the exact same time (like all at the top of every hour) can create resource contention; staggering schedules is a practical operational consideration in larger deployments.
Synonyms / related terms
| Term | Means | |---|---| | Cron scheduling | Fine-grained, custom interval scheduling using cron syntax | | Scheduled report | A report configured to run automatically on a recurring interval |
Concept Check
"A scheduled daily report uses a fixed, non-relative time range (a specific hardcoded date), and someone is confused why it shows the same results every single day it runs." This is expected given the configuration — a scheduled report needs a RELATIVE time range (like -24h or -1d@d) to actually produce fresh, current results on each scheduled run; a hardcoded fixed date will indeed return the same static results every time, regardless of the schedule.
Interview-style Q&A
Q: Why would an organization prefer scheduled PDF delivery over just telling people to log into Splunk and check a dashboard? A: "Not everyone who needs the information is a regular Splunk user, or has (or needs) direct access to the platform at all. Automatic PDF delivery gets a summary to stakeholders — like executives or external partners — through a channel (email) they already check daily, without requiring Splunk licenses, logins, or training for people who only need the end result, not the underlying analysis capability."
Memory trick
"Schedule it, Relative-time it, Deliver it" — the three things that make a scheduled report actually useful: an interval, fresh relative time bounds, and (optionally) automatic delivery to people who need it.