Why i can't see "savedsearches.conf" both in splunk_TA_for windows and splunk_TA_for unix and linux?

[AllandNothing]

I can't understand this, all other stuff works great, i receive all the information i enabled, i have installed these apps both on forwarders and search heads, all that is missing is the "savedsearches.conf". I would appreciate suggestions because for the moment is very important to obtain these searches for me.

[gcusello]

Hi @AllandNothing,

probably you didn't saved any alert or report in these apps but in different ones, for this reason you don't see savedsearches.conf in those apps.

Also because TA_Windows is also not visible and usually you don't use TA_nix.

Ciao.

Giuseppe

[AllandNothing]

Hello @gcusello, thanks for your answer,

in theory there arent't preconfigured searchs in these two apps? And in that case, why isn't present already wihout saving anything?

[gcusello · Accepted solution]

Hi @AllandNothing,

these are Add-Ons, so there isn't any alert or report saved in savedsearch.conf.

then I don't understand your second question.

Usually Alerts and Reports are in Apps, not in Add-Ons.

Ciao.

Giuseppe

[gcusello]

Hi @AllandNothing ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉