topic Re: Query about saved searches in Reporting

Query about saved searches

MHibbin — Thu, 22 Dec 2011 21:51:11 GMT

SplunkBase,

The following question is partially out of curiosity...

When a search string is saved as a report (e.g. a pie chart), where in the conf files is the information dictating the chart/report type used. I looked in the savedsearches.conf file, but there was no reference to the chart type, only to the search string, and some alert based options.

I have flicked through the rest of the App ($SPLUNK_HOME/etc/apps/<app_name/) directory but could not find a reference to the chart type, etc.

Apologies if I'm asking an obvious question, just haven't referenced this before.

Regards,

MHibbin

Re: Query about saved searches

gkanapathy — Thu, 22 Dec 2011 22:51:41 GMT

It's stored in personal viewstates.conf files under etc/users/, which are referenced by the vsid property in the savedsearches.conf file. However, these can (and should) be overridden by explicit setting if you use the search on an XML dashboard.

Re: Query about saved searches

MHibbin — Fri, 23 Dec 2011 09:05:16 GMT

Ok thanks I see now.