topic Re: Manual additions to savedsearches.conf overwritten by web GUI in Splunk Search

Manual additions to savedsearches.conf overwritten by web GUI

noahzstahl — Wed, 13 Jul 2011 20:48:32 GMT

Hello everyone.

The scenario:

I create a saved search using Splunk web
I want to use the search to populate a lookup table, so I add the relevant lines directly to the entry in savedsearches.conf (action.populate_lookup), and save. (These configurations can't be added through Manager, as far as I know)
Later, I want to make a change to the saved search, and do so through the Manager within web GUI. I click Save.
I notice that the lookup population configuration lines in savedsearches.conf have been deleted, apparently due to the entire stanza being overwritten by Splunk web.

The question:

Is there any way to avoid this scenario, i.e. have Splunk web be non-destructive to the saved search stanzas? Or could this be considered a bug?

Thanks,

Noah

Re: Manual additions to savedsearches.conf overwritten by web GUI

hazekamp — Wed, 13 Jul 2011 22:46:06 GMT

noahzstahl,

I would think this is a bug. We should not be overwriting the entire stanza. As a workaround you can use the inputlookup and outputlookup search commands to generate the lookup file instead of savedsearches.conf settings. This allows you to achieve everything via search syntax.

Example of a descructive output each time:

search = index=_internal | stats count by host, sourcetype | outputlookup my_lookup_table

To do a non-descructive lookup (useful when tracking stuff):

search = index=_internal | stats count by host, sourcetype | inputlookup append=T my_lookup_table | stats sum(count) as count by host, sourcetype | outputlookup my_lookup_table

-David

Re: Manual additions to savedsearches.conf overwritten by web GUI

noahzstahl — Tue, 23 Aug 2011 14:31:20 GMT

Thanks David. I like the idea of including everything in the search string.