5.6 Saving a Search Query as a Report Template

You can save a search query as a report template by using the Save as Report link in the Sentinel Log Manager /Web UI. You can use this report as a reference to create future reports. You can save the search query as a search report or as Jasper report.

5.6.1 Saving the Query as a Search Report

  1. Log in to Novell Sentinel Log Manager.

  2. Perform a search.

  3. To save the search query, click the save as report link.

    The Save as Report dialog box is displayed.

  4. Specify the following information:

    Report Name: Specify a name for the report template.

    Report Type: Specify the Event List option to save the report in the search report format.

    Search Query: Specifies the query used for the search.

  5. Specify the following information in the Default Report Result Parameters section:

    Name: Specify a name for the report.

    Email To: To mail the report template to a user, specify the e-mail address in the Email Report to field. To send the report template to more than one user, enter multiple e-mail addresses separated by commas.

    Sources: This option displays the number of sources that can be searched for events. This option is useful if distributed search is enabled. To select the sources that you want searched, click the Selected Sources link, then select the sources.

    Event Limits: To save more than 1000 results in a report, use the Event Limits text field to specify the number of results to show.

    By default, 1000 results are stored in a report template.

  6. (Optional) To generate report results immediately when you save the report results, select Generate report results on save using current search query.

  7. Click Save to save the report definition.

    You can see the saved report definition in the Report Viewer pane in the Sentinel Log Manager interface. To view the reports, see Viewing the Reports.

5.6.2 Saving the Query as a Jasper Report

  1. Log in to Novell Sentinel Log Manager.

  2. Perform a search.

  3. To save the search query, click the save as report link.

    A Save as Report dialog box is displayed.

  4. Specify the following information:

    Report Name: Specify a name for the report template.

    Report Type: Specify the Visualization option to save the report in the search report format.

    Search Query: Specifies the query used for the search.

  5. Specify any of the following information in the Default Result Parameters field, as required:

    • Name: Specify the name of the report.

    • Sources: This option displays the number of sources that can be searched for events. This option is useful if distributed search is enabled. To select the sources that you want searched, click the Selected Sources link, then select the sources.

    • Language: Choose the language in which the report labels and descriptions should be displayed. The reports written by Novell typically provide labels and descriptions in English, French, German, Italian, Japanese, Traditional Chinese, Simplified Chinese, Spanish, or Portuguese.

      The default value is the language with which the current user logged in, if that language is supported by the report. If the report does not support the language, the report’s default language is used.

      The data in the report is displayed in the language originally used by the event source.

    • Date Range: If the report includes time period parameters, choose the date range. All time periods are based on the local time for the browser.

      • Current Day: Specify this option to list events from midnight of the current day until 11:59:59 p.m of the current day. If the current time is 8:00:00 a.m, the report shows 8 hours of data.

      • Previous Day: Specify this option to list events from midnight of previous day until 11:59:00 p.m of the previous day.

      • Week To Date: Specify this option to list events from midnight Sunday of the current week until the end of the selected day.

      • Previous Week: Specify this option to list the last seven days of events.

      • Month to Date: Specify this option to list events from midnight the first day of the current month until the end of the selected day.

      • Previous Month: Specify this option to list events of a month, from midnight of the first day of the previous month until 11:59:00 p.m of the last day of the previous month.

      • Custom Date Range: Specify this option to list events for a specific period. If you select this option, you must also specify a start and end date.

    • Email Report To: Specify a valid Email ID, if you want the report to be mailed.

    • Event Limit: Specify the maximum number of event search results to be included in the report.

    • Minimum Severity: Specify the minimum severity value of the events to be displayed. The default value is 0.

    • Minimum Severity: Specify the maximum severity value of the events to be displayed. The default value is 5.

    • Preview: Click Preview to view the selected report before saving.

  6. To save the report result along with the report template, click Generate report results on save using current search query.

  7. Click Save to save the report definition.

    You can see the saved report definition in the Report Viewer pane in the Sentinel Log Manager interface. To view the reports, see Viewing the Reports.