Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- How to create a saved search?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to learn how to create a saved search - as appears in savesearches.conf. My end goal is to use a saved search to populate a lookup table.
Apparently, there is no documentation (I searched the docs for "saved search" -- no results) so I wondered if anyone knows how to do this. In the Search app, I see the link "Save As", but it looks like I can only save a Report, Dashboard Panel, Alert, or Event Type. Are those all saved searches? I saved a search, but savedsearches.conf was not modified.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Save as Report creates a saved search.
savedsearches.conf is created/modified in etc/apps/your_app/local folder, where your_app is the application context where you created and saved the search. In your case, it's most probably search. So look in $SPLUNK_HOME/etc/apps/search/local.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Save as Report creates a saved search.
savedsearches.conf is created/modified in etc/apps/your_app/local folder, where your_app is the application context where you created and saved the search. In your case, it's most probably search. So look in $SPLUNK_HOME/etc/apps/search/local.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ahh yes and in Settings -> Searches, reports, and alerts, if the permissions are set to "Private", the search goes to etc/users/<user>/search/local/savedsearches.conf instead. Thank you!
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
