To view the report result, you must run the report. All reports have a sample report result. You can use the sample report to preview how the actual report result looks like when you run the report. To run the report, you must have the Run reports permission.
You can run the report immediately or schedule it to run periodically. Click the Run icon and specify the appropriate information to schedule a report. By default, Sentinel saves the report in the PDF format.
Reports run asynchronously.Therefore, you can simultaneously perform other tasks in the Sentinel Main interface while the report generation is in progress. If the Sentinel server is restarted while the report generation is still in progress, you can either cancel or reschedule report generation. If you reschedule the report, it runs with the same parameters that you used initially. If you schedule a report with a relative time setting, such as Week to Date, the time period for re-running the report is based on the current date and time and not the date and time when you initially scheduled the report.
NOTE:The report data in the PDF file will be different than the data in the reports that are run with the Now option. The report data in the PDF file are for the time range that you specified while scheduling a report definition. When you schedule a report definition with the Now option, the report includes events from midnight to the time you scheduled the report definition.
You can schedule reports on Sentinel servers distributed across different geographic locations. For more information, see Configuring Data Federation
in the Sentinel Administration Guide.
You can also save a report in the CSV format along with the existing PDF format. This requires additional configuration in the Sentinel server. Only users in the administrator role can perform the additional configuration. For more information, see Generating a Report in CSV Format
in the Sentinel Administration Guide.