What determines the scope of data that appears in a scheduled report?
What determines the scope of data that appears in a scheduled report?
The scope of data that appears in a scheduled report is determined by all data accessible to the owner of the report. Scheduled reports and alerts run with the permissions of the report owner, meaning the data visible in the report will be constrained to what the owner has access to. While permissions settings can be configured to allow reports to run either as the User role or the owner's profile when shared, for scheduled reports, the data scope defaults to the owner's permissions.
D is correct When you share a report with other users, you have the option of having it run with the permissions of the report "owner" (the person who created the report) or the report "user" (the person who is running the report) Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner
It is D, slide 211 from Splunk Fundamentals 1
"Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner." Check: https://docs.splunk.com/Documentation/Splunk/7.2.6/Report/Managereportpermissions
D is correct. As documentation says the owner can configure it either way
"B" because of this the last sentence... Determine whether to run reports as the report owner or report user When you share a report with other users, you have the option of having it run with the permissions of the report "owner" (the person who created the report) or the report "user" (the person who is running the report). This setting is used for two reasons: It can allow access to search data that might otherwise be unavailable to the person running the report. It helps prevent situations where your concurrent search limit is reached when too many people run reports that you own. All reports run as Owner by default. Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner. From: https://docs.splunk.com/Documentation/Splunk/9.1.1/Report/Managereportpermissions
Option D is not the better answer because it talks about permission configuration which is not related to determining the scope of data that appears in a scheduled report. The scope of data that appears in a scheduled report is determined by the filters and criteria set by the report owner at the time of scheduling the report. The report owner can set the filter criteria based on their requirement, and the report will display the data that matches the criteria. Thus, option B is a better answer because it explains that the data accessible to the owner of the report will appear in the scheduled report.
But here it says "what determines the scope..." so i think its D
owner is the default view, but but the permissions can be changed.
D is correct, slide 211 of Splunk Material
Hi, any chance I can get the spunk material you referenced ? I'm a beginner and I want to write the certification exam asap, so any reading material I can get is appreciated.
B. All data accessible to the owner of the report will appear in the report.
IT IS BOTH C + D.
Creator sets the permissions
D, Agree
D is correct. Yes, owner is the default, but the permissions set on a report after the report is saved is what determines who can see it.
I believe answer should be B. Since for Scheduled Report, not matter how you configure the RunAs scope, it will default back to "Owner" base on the documentation. " Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner. "
D. Im agree
I agree with labarcaremo635. The correct answer is B. "Scheduled reports and alerts can only run as Owner. If you share a report so that it runs as User and then schedule that report, its permissions change to run as Owner." Check: https://docs.splunk.com/Documentation/Splunk/7.2.6/Report/Managereportpermissions