Is there a way to get back a saved search which is accidentally deleted? I cannot seem to find any "recycle bin" for deleted knowledge objects within Splunk Web.
It is sometimes too easy to hit the Delete-link of the wrong saved search...
There is no "recycle bin" for deleted knowledge objects in Splunk. You have some options, however.
Look in the audit log.
index=_audit savedsearch_name="SEARCH NAME"
Great answer, it works. Thx a lot!
There is no "recycle bin" for deleted knowledge objects in Splunk. You have some options, however.
Thanks. I will then just have to be very careful in deleting stuff...