topic Re: Splunk 6 - saved searches... now reports? in Reporting

Splunk 6 - saved searches... now reports?

nwieseler — Sun, 13 Oct 2013 02:32:48 GMT

Is there a way to enable the search bar within my report so I can make adjustments? Reading the docs I don't understand the best way make changes to a report I opened (what used to be called a saved search)?

Nick

Re: Splunk 6 - saved searches... now reports?

nwieseler — Sun, 13 Oct 2013 02:44:49 GMT

Edit button > Open in Search seems to be the only option I can figure out.

Extra step but I can live with it...

Nick

Re: Splunk 6 - saved searches... now reports?

nwieseler — Mon, 14 Oct 2013 15:33:18 GMT

There is also an option in the report screen to open in search which is handy...

Re: Splunk 6 - saved searches... now reports?

rroberts — Mon, 14 Oct 2013 15:42:26 GMT

Found this section in the .. http://docs.splunk.com/Documentation/Splunk/6.0/Installation/Aboutupgradingto6.0READTHISFIRST

doc.

"We have changed a number of the Splunk terms that you've come to know"

1.Manager, Splunk's main configuration interface, is now known as Settings.

2.Launcher, the initial menu you see when you run Splunk, is now known as Home.

3.Saved searches are now known as reports.

4.A saved search with an alert is now known as an alert.

5."TSIDX stats" are now known as indexed field statistics.

Re: Splunk 6 - saved searches... now reports?

nwieseler — Mon, 14 Oct 2013 15:47:59 GMT

Correct - I was more concerned with being able to make changes to a report I had opened. I missed the link in the GUI where it linked to "open in search"

Nick

Re: Splunk 6 - saved searches... now reports?

rroberts — Mon, 14 Oct 2013 15:53:37 GMT

Ah, gotcha.

Re: Splunk 6 - saved searches... now reports?

cbehm — Thu, 05 Dec 2013 17:02:24 GMT

This is a frustrating and (for our organization) useless change that appears to have no way to change the default behavior. Our users are technical users for whom a saved search should actually be a saved search by default, not a report.

There is a slightly better work-around in that you can bring back the your saved searches as a dropdown by adding the following to the navigation menu UI (from the search app go to Settings -> User interface -> Navigation menu):

Then the saved searches will be listed in a drop down as they were in Splunk 5 and will also have a magnifying glass that takes you to the search and not the report. Clicking the name still takes you to the report though.

I'll be submitting feedback to Splunk - at the very least allow the default behavior to be specified by user or as part of the saved search itself.

Re: Splunk 6 - saved searches... now reports?

nwieseler — Thu, 05 Dec 2013 20:45:22 GMT

Thanks for the tip. This is continues to be something I wish had not changed in the UI.

Nick

Re: Splunk 6 - saved searches... now reports?

colbymahan — Fri, 21 Feb 2014 21:10:12 GMT

Thanks! Just what i needed.

Re: Splunk 6 - saved searches... now reports?

nataliat — Mon, 24 Mar 2014 06:47:25 GMT

Thanks! So Useful 🙂