saved search index

mdmaala — Tue, 29 Sep 2020 23:44:07 GMT

is there a way that I can save a search that is common to all, so that when I ran it to make another search I wont have to include it in the search bar again? also to optimize the searching and make it faster

my search goes like this:
for machine 1:
source="C:\Users\Administrator\Documents\PATLITE\*" host="DESKTOP-G546H69" sourcetype="csv"
| rename "Green information" AS "Green" | rename "Amber information" AS "Yellow" | rename "Red information" AS "Red" | rename "User name" AS Username
| fields Date_Time, Username, Green, Yellow, Red |rex field=Date_Time "(?P\d{4}\/\d{2}\/\d{2})\s(?P\d{2}:\d{2}:\d{2})"
|sort -Time
|table Time, Username, Green, Yellow, Red
|search Username="Machine1"
|dedup Time
|sort 0 Time Username Green Yellow Red
|eval Time=strptime(Time, "%H:%M:%S")
|streamstats window=1 current=f last(Time) as prevTime last(Green) as cGREEN last(Yellow) as cYELLOW last(Red) as cRED by Username
|eval Duration=round(Time-prevTime)
|eval Duration = tostring(Duration, "Duration")
|eval Time=strftime(Time,"%H:%M:%S")
|eval prevTime=strftime(prevTime,"%H:%M:%S")
|table Duration cGREEN cYELLOW cRED

for machine 2:
source="C:\Users\Administrator\Documents\PATLITE\*" host="DESKTOP-G546H69" sourcetype="csv"
| rename "Green information" AS "Green" | rename "Amber information" AS "Yellow" | rename "Red information" AS "Red" | rename "User name" AS Username
| fields Date_Time, Username, Green, Yellow, Red |rex field=Date_Time "(?P\d{4}\/\d{2}\/\d{2})\s(?P\d{2}:\d{2}:\d{2})"
|sort -Time
|table Time, Username, Green, Yellow, Red
|search Username="Machine2"
|dedup Time
|sort 0 Time Username Green Yellow Red
|eval Time=strptime(Time, "%H:%M:%S")
|streamstats window=1 current=f last(Time) as prevTime last(Green) as cGREEN last(Yellow) as cYELLOW last(Red) as cRED by Username
|eval Duration=round(Time-prevTime)
|eval Duration = tostring(Duration, "Duration")
|eval Time=strftime(Time,"%H:%M:%S")
|eval prevTime=strftime(prevTime,"%H:%M:%S")
|table Duration cGREEN cYELLOW cRED

the ones in bold are the ones I want to save

Re: saved search index

nickhills — Wed, 20 Mar 2019 14:10:09 GMT

What you are describing is a macro. See here:
https://docs.splunk.com/Documentation/Splunk/7.2.4/Knowledge/Usesearchmacros

You create a macro which contains the first part of your search, and then run it with:

`my_macro`|search Username="Machine2" .....

Re: saved search index

mdmaala — Thu, 21 Mar 2019 01:37:27 GMT

thank you so much i'll try this!

topic Re: saved search index in Reporting

saved search index

Re: saved search index

Re: saved search index