create_report
Create a saved search report in your Splunk profile, optionally scheduled with a cron expression. Requires prior consultation of official Splunk docs to ensure correct SPL syntax.
Instructions
Create a report (saved search) under YOUR profile. Optionally scheduled via cron. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App namespace to create in. Default search. | |
| cron | No | Optional cron schedule (e.g. '0 6 * * 1'). Sets is_scheduled. | |
| name | Yes | New report name (unique within the app). | |
| latest | No | Dispatch latest time (e.g. now). | |
| search | Yes | SPL for the report. | |
| earliest | No | Dispatch earliest time (e.g. -7d@d). | |
| description | No | Optional description. | |
| docsConsulted | Yes | Must be true — confirms docs consulted. | |
| docsReference | No | The doc URL/section you used. |