Deployment Architecture

How to export a saved search for direct deployment?


My team is moving from working directly in splunk to a Git based deploy where we modify the app files directly. Previously we would create and save a search directly in the Splunk web UI but now add to the savedsearches.conf.

Is there a method for creating a saved search in the web app and extracting the sintax for savedsearachs.conf or another tool for helping this process? 

I've read the documentation for savedsearches.conf and much of the variables are niche in their use. Thanks for the help!

Labels (1)
0 Karma


Create the search on your Dev instance (or your workstation) then copy the stanza from savedsearches.conf to git.  When you've done that a few times, you'll have a feel for what to include in scratch-built stanzas.

If this reply helps you, Karma would be appreciated.


We currently don't have a Dev deployment and our deployment is one way, any changes made in the web app are overwritten when synced with git on a set schedule. A local splunk might work with an extra step; create the search in web app, paste to local, add alert/report conditions and scheduling, then copy to git.
I appreciate the help and might look into getting the team a dev app that we have direct access to. But getting legit logs in for testing is unlikely.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...