Schedule Report Panel

The Schedule Report panel allows you to schedule a customized report. Prior to scheduling a report, you can create a dynamic list (with the overwrite option selected) with services added. For more information, see "Generate a List from the Scheduled Report" section in Create and Schedule a Report. Then use the list to generate a report with details in the report like services and host names.


This workflow shows the procedure to create and schedule a report.


What do you want to do?

Role I want to ... Show me how
Administrator / Analyst

Configure Reporting Engine

For more information, see "Step 3: Configure Reporting Engine Data Sources" topic in the Reporting Engine Configuration Guide

Administrator / Analyst Create a List or List Group/Create or Deploy a Rule/Test a Rule Configure a Rule

Administrator / Analyst

Create and Schedule a Report*

Create and Schedule a Report

Administrator / Analyst View a report or list of all reports View a Report
Administrator / Analyst Investigate a Report Investigate a Report
Administrator / Analyst Manage/Access Control for lists, Rules or Reports Manage Lists, Rules or Reports

*You can complete these tasks here.

Related Topics

Quick View


To access this view:

  1. Go to Reports.
    The Manage tab is displayed.
  2. Click Reports.
    The Reports view is displayed.
  3. In the Reports panel, click netwitness_110_report_list_options.png > Schedule Report.


The Schedule Report view consists of the following panels:

1 Schedule Report View
2 Output Actions Panel

Dynamic List Panel

4 Logo Panel

Schedule Report View

The Schedule Report view allows you to schedule reports.


The following table lists the fields in the Schedule Report panel.

Field Description
Enable Enables the report schedules and runs the report.
Report Name The name of the report.
Schedule Name The name of the scheduled report configuration.
NetWitness DB The database can be NWDB and Warehouse DB depending on the type of database that you selected in the rule definition. If the report has rules of NWDB and Warehouse DB types, all the database types or rule types are displayed.
Warehouse Resource Pool If the report has rules of Warehouse DB, the Warehouse Resource Pool drop-down is displayed to select the pools or queues available in the cluster. If no pools or queues are entered for the Reporting engine, this field is disabled. For more information, see "Step 5: Configure Task Scheduler for a Reporting Engine" topic in the Host and Services Configuration Guide.

Provides the type of schedule for the run configuration:

  • Ad-hoc execution
  • Hourly execution
  • Daily execution
  • Weekly execution
  • Monthly execution
On The data range on which the query is run.
Use relative time calculation Uses the relative time duration to schedule a report.
Iterative Report Select the checkbox to schedule a report for the selected list value.
Iterate on List

Click this button to navigate to the List Selection panel and select a list. The following figure displays this panel:


The List Selection panel is a collection of Lists. The Reporting Engine maintains an active list of the available list names by continuously synchronizing with the collection to which it is connected.

Apply To Apply list values on the selected variable.

Displays the rule variables along with their associated values and the iterative properties included in the report.

Note: Depending on the rule chosen while creating a report, you can view dynamic variables defined for the rule in the Variables field of the Schedule Report panel. For example, Test-Country is the rule having the dynamic variable var.

Schedule Schedules the report.
Reset Resets the scheduled report.

Allows you to alter the Reporting Engine configuration details on the "Reporting Engine General Tab" topic in the Host and Services Configuration Guide.

Note: This button is visible on the Schedule Report panel only when you have the 'Manage Device' access permissions on the Reporting module.

Output Actions Panel

The Output Actions panel specifies output actions to notify the email recipient when the report execution completes and also sends reports in PDF and CSV formats as attachments in the email, based on your selection.


The following table lists the fields in the Output Actions panel.

Field Description
To A comma-separated list of email addresses to receive the output.
Subject The subject entered in the mail.
Body The body of the email. By default, the body field is populated with pre-defined text that has certain variables that will add meta appropriate to the generated report.
In the Reporting Engine, these variables are replaced with actual values.
  • ${RanAtStartTime} : The Start time of the report.
  • ${DataRangeStartTime} : The Start time of the data time range.
  • ${DataRangeEndTime} : The End time of the data time range.
  • ${LinkToSA} : The link to the NetWitnessHost from the email which in turn opens the report in NetWitness interface.
  • ${ReportName} : The name of the report.
  • ${DataSource} : The name of the data source.
Attach: The output format in which the report is attached to the email, such as PDF or CSV as configured in the Schedule Report dialog.
CSV Delimiter The default CSV delimiter is comma (,). If the CSV content contains a comma, you must identify a unique separator so the content is stored in its original form. For example, if msg is a column in the report to be saved as CSV and the msg content is as follows: ASA-SSM-CSC-20 Module in slot 1," application reloading ""CSC SSM"""," version ""6.2.1599.0"" CSC SSM scan services are reloading because of a pattern file or configuration update

The above content will be included in three columns due to the commas (,). To avoid this, you must specify a different delimiter such as a pipe line character “|”.

Note: To import the CSV file into Microsoft Excel, use the Data > From Text option in the Excel application. When you import the CSV file you must specify the file type of the file being imported as Delimited and use the same delimiter that you specify to generate the CSV file.

Multivalue Delimiter The data in multivalued fields are separated by the multivalue delimiter. The default Multivalue delimiter is two pipe line characters (||).
Other Options You can select an SFTP, URL, or Network Share location configured in ((RE}} and then send the report either in PDF or CSV format based on the requirement.
netwitness_110_other_options.png Select this option to send the report to the SFTP, URL or Network Share location configured in the Reporting Engine Services Config view.
Type The type of output action chosen. For example, SFTP, URL or Network Share.
Output Actions Select the SFTP, URL or Network Share name configured in the Reporting Engine Services Config view.
Send as PDF / Send as CSV Select these options to send the report either in PDF or CSV format, or both to the configured Notification Server (SFTP, URL or Network Share).

Dynamic List Panel

The Dynamic List panel populates the lists created and you can add, edit or delete the list. The list is generated based on the scheduled report which can be viewed in the Lists view.


The following table lists the operations in the Generate List panel.

Operation Description
netwitness_110_add_button.png Adds a new list to the report.
netwitness_110_del_button.png Deletes all the lists added to the report.
netwitness_110_edit_button.png Displays the Generate List dialog.
List Name The name of the list chosen from the List Selection panel. For more information on the List Selection panel topic, see Generate List Panel.

Logo Panel

The Logo panel populates the default logo from the Select a Logo panel. For more information on choosing a logo from this panel, see "Manage and Select a Report Logo" section in the Manage Lists, Rules or Reports.

You can set the default logo for a Reporting Engine. This is the logo that is used in the generated reports. For more information on choosing a logo, see Select a Logo Dialog.

Note: If you have not selected any logo then the default NetWitness logo is used on the report. The option Save as PDF for the previously executed reports does not support a new customer logo. It displays the default NetWitness Logo, if the customer logo must be displayed in the Schedule a Report view.