How can I create both a saved search and a table out of data from the Splunk App for AWS

[ScottMacD]

Background: I was told yesterday that I needed to create a custom dashboard for the Splunk App for AWS out of performance information we were already receiving in other dashboards.

The Problem: Today I find out, that what we ACTUALLY needed was information [from Splunk App for AWS] to (1) populate a saved search and (2) get it into a table.

Is there a way to make that data from the dashboard populate a saved search and then a table?

[woodcock]

Just add | outputcsv MyLookupDefinition to the panel's search and then you can do | inputcsv MyLookupDefinition to load it elsewhere. Alternatively, you can save the search in the panel as a saved search and then reference it with |savedsearch and then load that elsewhere with | loadjob

[ScottMacD]

I should say that the data populates Dashboard panels already, but it needs to be put into a saved search/table.

[kmorris_splunk]

A saved search in Splunk is the same thing as a Report. You could start by opening the panel in your existing dashboard that uses that data in search (hover over the panel and click the magnifying glass at the bottom. This will open the search for that panel. Modify the search to represent your data in a table, then save it as a Report (Save As...Report).