Creating a Saved Search for Reporting in Guardian

Creating a saved search in Guardian is a foundational skill for building reports, exporting data, or feeding specific data sets into visualizations. To show you how this works, let's walk through an example of how to build a saved search specifically to report on all deletions this week. Since you are building this for reporting, you will want to focus not just on the query, but also on how the data is formatted in the table.

Step 1: Navigate to the Discover Panel

The "Discover" tab is your primary workspace for exploring your data and building saved searches.

1. Open your Guardian interface and login as editshare_admin.

2. Click on the Hamburger menu (three horizontal lines) in the top-left corner.

3. Under the "OpenSearch Dashboards" section, click on Discover.

Step 2: Select Your Index Pattern and Starting Point

You need to tell OpenSearch which dataset you want to query.

1. On the left-hand side, just below the search bar, click the dropdown menu.

2. Select the efs-audit-* index pattern.

3. Optional: If you want to use an existing layout as your baseline, go to the top menu bar, click Open, and select "EFS Audit Event Table" as a starting point. This will load a pre-configured set of columns and filters that you can tweak for your specific report.

Step 3: Define Your Time Range

Since we want to see deletions for the current week, we need to adjust the time frame.

1. Go to the top-right corner of the screen and click the Time Picker (it usually defaults to "Last 15 minutes").

2. Select This week (or "Last 7 days" depending on how you prefer to measure your weeks).

Note: When you save the search, you may have the option to save this specific time range with it. This is highly recommended for automated reporting so the report always pulls the correct window of data.

Step 4: Build Your Query and Filters

Now, narrow down your data to exactly what needs to be in the report—in this case, deletions.

1. Use the Search Bar to type Dashboards Query Language (DQL) or Lucene to filter results (e.g., efs.event: "delete").

2. Use the + Add filter button just below the search bar to visually build exact matches or ranges for your data if you need to narrow it down further (like filtering for a specific user).

Step 5: Save the Search

Once your data is filtered to exactly what you want to report on, it is time to save it.

1. Click the Save button in the top menu bar (next to the search bar).

2. Give your search a clear, descriptive Title (e.g., "Weekly EFS Audit Deletions Report").

3. Important: If you used an existing table as a starting point in Step 2, be sure to toggle on Save as a new search so you do not overwrite the original template.

4. Check the box that says Store time with search so this saved search always defaults to the weekly time range you set in Step 3.

5. Click the final Save button.

How to Use Your Saved Search for Reporting

Now that your search is saved, you can use it in a few different ways:

• Generate a CSV Report: Open your saved search in the Discover tab. In the top-right menu area, click Reporting (or Share then CSV Reports, depending on your exact setup).

• Build a Dashboard Table: Go to the Dashboards tab, create a new dashboard, click "Add", and select your saved search to drop the table directly onto the dashboard.

• Feed Visualizations: When creating a new chart, you can select your Saved Search as the primary data source instead of the raw index pattern.