NOTE: I am an ‘end user’ and not involved in support/maintenance or configuration. I may, or may not, have access to configuration. If directed to configuration, I’m afraid I would need some detailed instruction, which I may direct to our support.
The organisation in which I work is moving to OpenSearch due to a change in the platforms from which it collects data (indexes). The older version of OpenSearch (I think 2.6.0., but Stack Management shows 2.3.0 ) had the Reporting capability directly available in Discover
However, when trying to use Reporting, it fails and we have been told (by support) that it is a known issue and doesn’t work. I have had to swap environment in which version 2.16.1 is installed (I can’t actually see a version in the GUI management?). This does NOT have Reporting available directly in Discover.
To run a report, we have been told we have to save it. This seems very inefficient, as Discover gives the ability to customise ad-hoc searches, allowing for easy modification from the Search bar, ie I can add filters (which I happily save), but also, as an example, search for a telephone number 447712345678* within the Search bar. I then want to report, change the telephone number 447787654321*, and report again. It would obviously be more efficient to do this without having to save every variation, which I assume to be the point of having Reporting ‘within Discover’, which now appears to be lost.
NB When I have saved my report, the Search bar wildcard is saved. I go to the Reporting Plugin, run the report with my selected dates, which works, but my selected columns have been lost, defaulting back to something I have not specified, making the report CSV unreadable without editing in Excel and removing and rearranging. TBH I haven’t even tried doing this, as it isn’t worth the effort, and I don’t even know if the columns I actually want are there.
My question is, is it possible to have Reporting directly available in Discover 2.16, and for me to use ad-hoc search strings from the the Search Bar (without resaving every time), and for my selected columns to be in the report?