The Schedule Report dialog enables you to create a schedule for the report. Reports can be scheduled hourly, daily, weekly, or monthly. In order to schedule a report at a specific time or on a daily, weekly, or monthly basis, you must configure the scheduling options on the Schedule report dialog.  Additionally, administrators and analysts can configure charts for reports. Using this feature, administrators and analysts can create various types of charts based on Event Count, Session Size, Packet Count, and Meta Key.

To access this dialog, while investigating a service in the Investigate > Events view, add a query on the query search bar > three_dots.png > Schedule Report from the toolbar.

What do you want to do?

User Role I want to ... Show me how

Administrator / Analysts

Schedule Report

Generate Reports from Events View

Related Topics

Quick Look - Schedule Report Dialog

This is an example of the Schedule Report Dialog.

Schedule_chart_reports.png

The following table describes the fields in the Schedule Report Dialog view.

Feature Description
Report Name Specifies a name to identify the panel. In the example, the name is Report on Investigate Query - 2023-04-25 10-18-26. You can provide a name that clearly identifies the nature of events that will be added to this report.
Limit A selection list for the maximum number of results to be displayed in the generated output. By default, the limit is 20 and you can specify a maximum number of 100 results.
Run Time interval to use for running the scheduled job:

  • Later: Runs on specific date and time.

  • Hourly: Runs on a designated repeating interval. For example, if you schedule the report for 50 minutes, for every 50th minute, the report will be prepared.

    Note: A maximum of only 59 minutes can be selected.

  • Daily: Runs daily at a designated time. For example, if you schedule the report at 04:25, the report will be prepared at 04:25 AM every day.

  • Monthly: Runs on a monthly basis at a designated time and day of the month. For example, select 25 for the 25th day of the month. The report will be prepared on the 25th month of every month.

    Note: During the monthly report generation process, a message will appear if the day is greater than 28. This will notify the user that the report will be scheduled for the month containing that day.

     
ON

Set the frequency, duration, and time for running the report:

  • Past: You can schedule the report based on Hours, Days, Weeks, Months, and Years.

  • Range(specific): You can schedule the report for a specific date and time range.

    Note: This field appears only if you select Later in the Run field.

  • Range(generic): You can schedule the report for a generic date and time.

    Note: This field appears only if you select Later, Daily, Weekly, and Monthly in the Run field.
Use relative time calculation

The Use relative time calculation option is enabled by default, and it uses the relative time duration to schedule a report.

For example, if you schedule a report to run over the past 1 hour –1h for the relative time, the time is exactly 1 hour from when the report is run. If the current time is 3 P.M., the events that occurred in the past 60 minutes or between 2 P.M. and 3 P.M. today.
Chart Type

Displays a drop-down listing chart type options:

  • Tabular(Default)

  • Pie

  • Area

  • Bar

  • Bubble

  • Column

  • Line

  • Step line

  • Step Area

  • Spline Area

  • Spine
Summarize

Displays a drop-down listing different in-built aggregate meta options to obtain the desired summarized meta values:

  • Event Count: The total number of events that have occurred at a specific time.

  • Session size: The total size of the events recorded by services at a certain time.

  • Packet Count: The total number of packets that have been transmitted or received.
Meta Key

Displays a drop-down listing different meta key options.

Note: You can select only one meta value at a time.
Email Output Action Specify email addresses to send the report to, separated by commas.
Create Creates the report and closes the dialog. A message confirms that the report was scheduled successfully.

Cancel

Closes the dialog without applying changes.