Is there a way to retrieve a saved search that was accidentally deleted?

[Urias]

Is there a way to get back a saved search which is accidentally deleted? I cannot seem to find any "recycle bin" for deleted knowledge objects within Splunk Web.
It is sometimes too easy to hit the Delete-link of the wrong saved search...

[eugenek]

Look in the audit log.

index=_audit  savedsearch_name="SEARCH NAME"

[robertszekeres]

Great answer, it works. Thx a lot!

[richgalloway · Accepted solution]

There is no "recycle bin" for deleted knowledge objects in Splunk. You have some options, however.

• If the savedsearch was shipped as part of an app, it may still be present in $SPLUNK_HOME/etc/apps//default/savedsearches.conf. If it is there, you can copy it to local/savedsearches.conf.
• Restore the affected savedsearches.conf file from your last backup. Do this in a separate location and then copy only the deleted search to the current savedsearches.conf file (or create the search in the UI).
• Look for a copy of the deleted saved search in a user's directory or in another app.

[Urias]

Thanks. I will then just have to be very careful in deleting stuff...