Archive

how to use saved search in the middle of query

alt text

see the below image , how to save the highlighted section of the search in a saved search.. So that I can reuse that

Tags (1)
0 Karma

Motivator

I can see a lot of field extractions and evals in the highlighted section.
I think it might be best if you create field extractions and calculated fields via Settings / Fields. Then the fields will be automatically created for every search.

0 Karma

SplunkTrust
SplunkTrust

@abhishekdubey006

if you want to reuse search portions in mutliple searches then use macros.

http://docs.splunk.com/Documentation/Splunk/7.2.1/admin/macrosconf

I don't have access of admin user so how to use through UI

0 Karma

SplunkTrust
SplunkTrust
0 Karma

macro will not work in the middle of the query

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!