Skip to main content
Skip table of contents

Create Reports

 Use the Report Wizard to create and modify Custom Reports and to view the configuration of reports you do not have permission to modify. To create a new report

  1. On the Tools menu, click Report, and then click Report Center.
  2. Click the Reports tab.
  3. On the main toolbar, click the New icon.
    The Report Wizard appears.
  4. On the Select Report Template page, select the report template you want and click Next.

    Log Volume reports (Class = Log Management) return data for all log sources. Specifying log source criteria does not narrow the results.

  5. On the Specify Log Source Criteria page, specify the Log Sources to include in the Report and click Next.
  6. On the Specify Additional Report Criteria page, add any filters needed to limit the data included in the report. For more information on filters, see Work with Filters.

    Filters are not applied when running Log Volume reports (Class = Log Management). Log Management Reports are designed to ignore filters.

    Restricted Analysts cannot create or edit a User (Impacted/Origin) by Active Directory Group filter. The User (Impacted/Origin) by Active Directory Group filter is only available to Global Administrators and Global Analysts.

    Restricted Analysts can run objects that reference an Active Directory Group filter in saved Reports and Report Packages.

    If you are running a report type that summarizes data by the top N events, filter NULL values out of your data. To do this, manually create a filter where the Filter Mode is Filter Out (Is Not) and the Filter out Null values? check box is selected.

  7. Click Next.
    The Report Wizard Details and Configuration page appears.
  8. Type the Report Details.
    1. Enter the Report Name.
    2. (Optional) Enter any qualifiers to print on the report.
      Qualifiers are optional, but they allow you to print additional information, such as the sorting or selection method, the affected user group, or the sources.
      For example:
      Name = Summary Log Count
      Qualifier 1 = of Events
      Qualifier 2 = by Ascending Log Count
    3. (Optional) Enter a description to include in the report list. The description does not appear on the report.
  9. Complete the Report Configuration.
    1. Select a Report Class.

      Report ClassesDescription


      System diagnostics
      Log ManagementLogRhythm usage and log collection
      AuditMaintenance of Entities, Hosts, Users, etc.
      SecuritySecurity and compliance-related events
      OperationsError conditions
      General PurposeSummarizing log counts according to Hosts, Ports, etc.
      Event ManagementEvents and Alarms
      Case Management
    2. Specify the Report Data Source (Platform Manager, Data Processor, LogMart) to use as input data. If a source appears dimmed, it is unavailable.

      Reports run against the Data Processor pull their data from the Data Indexer. Therefore, the amount of data pulled in those reports is controlled by the effective TTL of your Data Indexer. You may have 30, 60 or even 90 days of configured TTL for your indexer, but if drive free space hits 80% then the oldest index will be deleted.

    3. Specify the Report Permissions to determine the access level for the report.
    4. Configure Intelligent Indexing:
      • Select Enable Intelligent Indexing, if necessary.
      • Select Enable Expiration, if necessary.
  10. To save the Report and exit the Report Wizard, click OK.

    When viewing a Report, you cannot modify the Report Wizard fields.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.