topic Re: Is there a way to retrieve a saved search that was accidentally deleted? in Getting Data In

Is there a way to retrieve a saved search that was accidentally deleted?

Urias — Thu, 15 Dec 2016 09:13:05 GMT

Is there a way to get back a saved search which is accidentally deleted? I cannot seem to find any "recycle bin" for deleted knowledge objects within Splunk Web.
It is sometimes too easy to hit the Delete-link of the wrong saved search...

Re: Is there a way to retrieve a saved search that was accidentally deleted?

richgalloway — Thu, 15 Dec 2016 13:21:36 GMT

There is no "recycle bin" for deleted knowledge objects in Splunk. You have some options, however.

If the savedsearch was shipped as part of an app, it may still be present in $SPLUNK_HOME/etc/apps//default/savedsearches.conf. If it is there, you can copy it to local/savedsearches.conf.
Restore the affected savedsearches.conf file from your last backup. Do this in a separate location and then copy only the deleted search to the current savedsearches.conf file (or create the search in the UI).
Look for a copy of the deleted saved search in a user's directory or in another app.

Re: Is there a way to retrieve a saved search that was accidentally deleted?

Urias — Thu, 22 Dec 2016 08:01:15 GMT

Thanks. I will then just have to be very careful in deleting stuff...

Re: Is there a way to retrieve a saved search that was accidentally deleted?

eugenek — Mon, 27 Nov 2017 13:32:20 GMT

Look in the audit log.

index=_audit  savedsearch_name="SEARCH NAME"

Re: Is there a way to retrieve a saved search that was accidentally deleted?

robertszekeres — Mon, 17 Sep 2018 10:26:44 GMT

Great answer, it works. Thx a lot!