update_report
Update existing Splunk reports by replacing their SPL search, schedule, and description. Verifies edit access first and requires documentation consultation before making changes.
Instructions
Update an existing report. Pre-checks edit access; refuses if can_write is false. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App namespace. Default: the report's current app. | |
| cron | No | Optional cron schedule. | |
| name | Yes | Existing report name. | |
| owner | No | Owner. Default: the report's current owner. | |
| latest | No | Dispatch latest time. | |
| search | Yes | New SPL. | |
| earliest | No | Dispatch earliest time. | |
| description | No | Optional description. | |
| docsConsulted | Yes | Must be true. | |
| docsReference | No | The doc URL/section you used. |