topic Re: Convert saved search to inline search in Splunk Search

Convert saved search to inline search

ma_anand1984 — Thu, 23 Aug 2012 09:58:07 GMT

I have a dashboard with 10 graphs all pointing to one saved search each. what is the easiest way to convert all of them to inline search at One GO?

Re: Convert saved search to inline search

MHibbin — Thu, 23 Aug 2012 10:36:41 GMT

To check my understanding, you want to convert 10 savedSearches into 10 searches which generate 10 panels on your dashboard?

Did you create your view using XML? - Or did you create it through the tools provided by Splunk (i.e. Search>> Create...>> Dashboard panel)?

If you did it using the tools provided by Splunk, the quickest way I can think would be to navigate to the view, click the "Edit" button, and then for each panel, edit the search, and then click "edit in-line" (or something to that effect).

Other than that the quickest way would be to copy the search strings from the saved searches to a notepad (or something similar) and then edit the XML directly, by replacing your saved searches with searches and adding the search string.

No one-shot method that I've come across, as there are multiple searches being used. You can look at the UI examples app for help on a lot of dashboarding requirements.

Hope this helps,

MHibbin

Re: Convert saved search to inline search

ma_anand1984 — Tue, 28 Aug 2012 08:16:03 GMT

thank you MHibbin for your time. I'm aware of both the methods you told. I was checking whether there is any magic that does it in one Shot.

Re: Convert saved search to inline search

pbugeja — Sat, 28 Jan 2017 19:02:03 GMT

Relatively new user of Splunk and have noticed a possibly bug with the "Clone to Inline Pivot" functionality when editing a Dashboard Panel by clicking on the Search Report icon in order to use a Time Range Picker for Panels in a Dashboard. This will be very handy function to synchronize all panels in a dashboard.

I click on Inline Search icon, choose "Clone to Inline Pivot" and it does not change the icon to Inline Search, hence not prompted to add the Time Range Picker to the panel.

I am using Splunk Enterprise 6.5.1

Thanks, Paul