topic Re: how to clone a search window in Splunk Search

how to clone a search window

elenzil — Thu, 03 May 2012 22:54:03 GMT

say i've got an interesting search going; it's yielding some pretty good values, but i think i might want to tweak it.

what i'd really like to do is just clone the whole splunk window, and modify the clone.

what i actually have done is written a little bash script to convert a search line into a URL - i copy my search term into the system clipboard, pipe it through my bash script, then paste the results into the URL bar in a new browser window.

it would be awesome if splunk had a button to do this for me, preserving the timerange from the original window.

Re: how to clone a search window

Drainy — Fri, 04 May 2012 08:08:58 GMT

I can see the benefits of that, although in Chrome you can already right click and duplicate a tab. Though this won't preserve any results that Splunk might have already fetched it will preserve the search and time range.

Also you could always create it as a saved search and run that from the search window and just modify/clone it via the saved searches screen.

Re: how to clone a search window

elenzil — Mon, 07 May 2012 17:27:35 GMT

thanks Drainy!

oh interesting - w/ splunk 4.3 it looks like the URL keeps up-to-date with the search you're working on, so just copying the URL is sufficient. that's great. previously that wasn't the case.

saving a search and editing it technically works, but practically has a couple issues: 1) it takes a lot of time to do. 2) it pollutes your saved-search space.