Created app from template - unable to save searches from flashtimeline view


5.0.1 environment.

When I create a new app from either the barebones or sample app template, hit the link in the nav bar to search, I'm unable to save any searches from the pulldown save options - all are greyed out. Similarly the only thing under the create button is event type. For kicks I created a copy of the flashtimeline.xml from the search app, renamed it, put it in my sample app, and adjusted the link in the nav bar - no change. I've also looked at a few apps downloaded from Splunkbase and they seem to have the same behavior (eg., MS Exchange app). This seems like a permissions issue though from the looks of things I have write rights (admin) at the various permissions screens in the app and views, etc.

While you can go into the saved searches via the manager and manually create a saved search this is cumbersome. What I'm after is to create an app for various lines of business so they use 'their' app instead of the search app. Would also like for this app to have the same ability to save searches, create alerts, dashboards, etc all within the context of that app.

Tags (1)
0 Karma


Hahaha I'm an idiot. You have to actually hit the search button and then save/create. This was a case where I knew the search I wanted to save I guess - need more caffeine or something.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!