Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- How to reload Global savedsearches
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to reload Global savedsearches
If I have saved my searches globally, ie in the file
$SPLUNK_HOME/apps/search/local/savedsearches.conf
is it then possible to reload changes somehow?
I have tried several restart/reload options but none seem to work.
- splunk _internal call /services/admin/search/data/ui/nav?refresh=1
- splunk _internal call /services/apps//
- splunk restartss
Obviously if I edit them in the GUI, they will be reloaded but I have changed names to them and would like the new names to appear.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This works for my app savedsearches.conf too.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I mean the web link works for my app's savedsearches.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use this command to reload the saved searches:
splunk _internal call "/admin/savedsearch/_reload"
or via Splunkweb visit the URI /debug/refresh?entity=admin/savedsearch
eg. http://localhost:8000/debug/refresh?entity=admin/savedsearch
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I reload the savedsearch.conf for my specific app?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The internal call needed to like this: splunk _internal call /servicesNS/admin/search/admin/savedsearch/_reload -auth username to work. But the web link was useful, it reloads everything. https://servername/en-US/debug/refresh
Aligning Observability Costs with Business Value: Practical Strategies
Mastering Data Pipelines: Unlocking Value with Splunk
Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0
