Reporting

How to create a saved search?

Path Finder

I want to learn how to create a saved search - as appears in savesearches.conf. My end goal is to use a saved search to populate a lookup table.

Apparently, there is no documentation (I searched the docs for "saved search" -- no results) so I wondered if anyone knows how to do this. In the Search app, I see the link "Save As", but it looks like I can only save a Report, Dashboard Panel, Alert, or Event Type. Are those all saved searches? I saved a search, but savedsearches.conf was not modified.

Tags (1)
1 Solution

Builder

Save as Report creates a saved search.

savedsearches.conf is created/modified in etc/apps/your_app/local folder, where your_app is the application context where you created and saved the search. In your case, it's most probably search. So look in $SPLUNK_HOME/etc/apps/search/local.

View solution in original post

Builder

Save as Report creates a saved search.

savedsearches.conf is created/modified in etc/apps/your_app/local folder, where your_app is the application context where you created and saved the search. In your case, it's most probably search. So look in $SPLUNK_HOME/etc/apps/search/local.

View solution in original post

Path Finder

Ahh yes and in Settings -&gt; Searches, reports, and alerts, if the permissions are set to "Private", the search goes to etc/users/<user>/search/local/savedsearches.conf instead. Thank you!

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!