Dashboards & Visualizations

Can you save a search that also produces an error?

nick405060
Motivator

Hi,

I have a search that produces an error when directly ran in the interface, but it's meant to be called with | savedsearch so the error is okay with me. Since it produces an error though, the interface will not let me save it. How do I save this search so that I can call it?

Search:

| makeresults | multireport 
[| savedsearch "$exchange_toggle$" earliest_epoch="$earliest_epoch$" latest_epoch="$latest_epoch$" network_id="$network_id$"]
[| savedsearch "$badge_toggle$" earliest_epoch="$earliest_epoch$" latest_epoch="$latest_epoch$" network_id="$network_id$"]
[| savedsearch "$vpn_toggle$" earliest_epoch="$earliest_epoch$" latest_epoch="$latest_epoch$" network_id="$network_id$"]
| sendemail to="$send_to$" server=smtp.mycompany.com subject="Here is your requested Splunk report." message="Results:" sendresults=true inline=true sendcsv=true

Called from this in a dashboard:

... | savedsearch user_activity_master earliest_epoch="$earliest_epoch$" latest_epoch="$latest_epoch$" network_id="$network_id$" send_to="$send_to$" exchange_toggle="$mytoken1$" vpn_toggle="$mytoken2$" badge_toggle="$mytoken3$"
0 Karma
1 Solution

nick405060
Motivator
0 Karma

nick405060
Motivator
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.